CVE-2026-105863

LOWCVSS 9.2 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-290CWE-915

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR18h
🚨Critical - Payload CMS Auth Token Claim Injection via Custom Field Mapping (CVE-2026-105863) Payload headless CMS allows a custom field option to map to reserved auth claim names; at login, user-controlled field values are written into the JWT/auth token claim set, enabling privilege/identity manipulation. Instances not using custom field-to-claim mapping are not impacted. 👉Affected: payload > 3.0.0 and < 3.90.0; 4.0.0 canary builds | Upgrade to 3.90.0
0000039
312 followersView on X

Explore more

Back to dashboard