GHSA-66wr-7vmr-p5jq
Payload authentication token field handling issue
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-105863
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
### Impact Under certain field configurations, Payload could include unintended values in the authentication token issued at login. You are affected if: - You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name. ### Patches Payload now restricts which field configuration options can influence the contents of the authentication token. Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds There is no complete workaround. Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · payload | introduced 3.0.0, fixed 3.90.0 |
| npm · payload | introduced 4.0.0-canary.0, fixed 4.0.0-canary.34 |
Références
- https://github.com/payloadcms/payload/security/advisories/GHSA-66wr-7vmr-p5jq WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-105863 ADVISORY
- https://github.com/payloadcms/payload/commit/56cd5cd050a57daebf33159e41e5ff9d4a45239c WEB
- https://github.com/payloadcms/payload PACKAGE
- https://github.com/payloadcms/payload/releases/tag/v3.90.0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |