UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105846

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Severity
Medium 6.1
Published
6 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.88.0
Sources
NVD

Affected software

SoftwareAffected versions
Payload CMSServers and applications · cpe:a:payloadcms:payload
  • Version 4.0.0-canary26
  • Version 4.0.0-canary25
  • Version 4.0.0-canary24
  • Version 4.0.0-canary23
All 28 release lines
  • From 3.40.0 before 3.88.0
  • Version 4.0.0-canary0
  • Version 4.0.0-canary1
  • Version 4.0.0-canary2
  • Version 4.0.0-canary3
  • Version 4.0.0-canary4
  • Version 4.0.0-canary5
  • Version 4.0.0-canary6
  • Version 4.0.0-canary7
  • Version 4.0.0-canary8
  • Version 4.0.0-canary9
  • Version 4.0.0-canary10
  • Version 4.0.0-canary11
  • Version 4.0.0-canary12
  • Version 4.0.0-canary13
  • Version 4.0.0-canary14
  • Version 4.0.0-canary15
  • Version 4.0.0-canary16
  • Version 4.0.0-canary17
  • Version 4.0.0-canary18
  • Version 4.0.0-canary19
  • Version 4.0.0-canary20
  • Version 4.0.0-canary21
  • Version 4.0.0-canary22
  • Version 4.0.0-canary23
  • Version 4.0.0-canary24
  • Version 4.0.0-canary25
  • Version 4.0.0-canary26

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-105846
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105846