Loading...
Skip to main content
GeekWala

CVE-2026-105863 — Vulnerability in payload — CVE Details

CRITICAL

Payload authentication token field handling issue

Published October 7, 2026Updated October 7, 2026Source: osv

Summary

### Impact Under certain field configurations, Payload could include unintended values in the authentication token issued at login. You are affected if: - You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name. ### Patches Payload now restricts which field configuration options can influence the contents of the authentication token. Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds There is no complete workaround. Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

Advisory Timeline

  • First published October 7, 2026 (4 days ago).
  • Last revised October 7, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update payload to 4.0.0-canary.34 or later
npm install payload@4.0.0-canary.34
npm
Update payload to 3.90.0 or later
npm install payload@3.90.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
payload
npm
All versions4.0.0-canary.34
payload
npm
All versions3.90.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-105863?
Payload authentication token field handling issue This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.3/10).
How do I check if my project is affected by CVE-2026-105863?
CVE-2026-105863 affects payload. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-105863 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.3

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-66wr-7vmr-p5jq

Related CVEs

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies