CVE-2026-105863
Payload is a free and open source headless content management system.
Published Oct 6, 2026 · updated Oct 15, 2026 · payloadcms payload
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2026 · NIST NVD
Detected
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
Oct 15, 2026 · NIST NVD
Updated
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
Affected
- cpe payloadcms/payloadversion unspecified
- cpe payloadcms/payload4.0.0
Sources
- CVE.orgCVE-2026-105863
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-105863
30-day exploitation probability 0.4%
first.org - NIST NVDCVE-2026-105863
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is
nvd.nist.gov