Is CVE-2026-105866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105866 being exploited in the wild.

How severe is CVE-2026-105866?

Medium severity, with a CVSS score of 4, published 6 October 2026.

Which products and versions are affected?

payload (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34.

Is there a fix for CVE-2026-105866?

Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105866 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105866?

Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105866: Payload CMS account lockout denial of service

CVE-2026-105866 · Severity: medium · CVSS 4 · Published 2026-10-06

Payload is a headless content management system used to manage and deliver digital content. An unauthenticated attacker who knows a user's email address or username can repeatedly trigger the account lockout mechanism, permanently preventing legitimate users from logging in without administrator intervention.

Technologies: payload (npm), Payload CMS. Vendors: npm, Payload.

Quick answers

Is CVE-2026-105866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105866 being exploited in the wild.
How severe is CVE-2026-105866?: Medium severity, with a CVSS score of 4, published 6 October 2026.
Which products and versions are affected?: payload (npm) SEMVER:introduced=0,fixed=3.90.0; Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34.
Is there a fix for CVE-2026-105866?: Yes. payload (npm): upgrade to 3.90.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105866 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105866?: Check whether you run payload (npm) or Payload CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

payload (npm): upgrade to 3.90.0 or later
```
npm install payload@3.90.0
```

Technical details

The vulnerability exists in the local-authentication collection's account lockout mechanism, which can be abused by unauthenticated attackers to lock valid accounts. No valid credentials are required—only knowledge of a target email or username is sufficient to trigger repeated lockout events. The issue was fixed by resetting the account lock on password reset and by throttling forgot-password requests.

Affected products

Payload Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34

Identifiers

CVE-2026-105866
GHSA-v5gf-vpjc-pc7w

Timeline

2026-10-06: disclosed
2026-09-18: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.