UpHeron
All vulnerabilities

Servers and applications

CVE-2026-105863

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

Severity
Critical 9.2
Published
6 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.90.0
Sources
NVD

Affected software

SoftwareAffected versions
Payload CMSServers and applications · cpe:a:payloadcms:payload
  • Version 4.0.0-canary33
  • Version 4.0.0-canary32
  • Version 4.0.0-canary31
  • Version 4.0.0-canary30
All 35 release lines
  • From 3.0.0 before 3.90.0
  • Version 4.0.0-canary0
  • Version 4.0.0-canary1
  • Version 4.0.0-canary2
  • Version 4.0.0-canary3
  • Version 4.0.0-canary4
  • Version 4.0.0-canary5
  • Version 4.0.0-canary6
  • Version 4.0.0-canary7
  • Version 4.0.0-canary8
  • Version 4.0.0-canary9
  • Version 4.0.0-canary10
  • Version 4.0.0-canary11
  • Version 4.0.0-canary12
  • Version 4.0.0-canary13
  • Version 4.0.0-canary14
  • Version 4.0.0-canary15
  • Version 4.0.0-canary16
  • Version 4.0.0-canary17
  • Version 4.0.0-canary18
  • Version 4.0.0-canary19
  • Version 4.0.0-canary20
  • Version 4.0.0-canary21
  • Version 4.0.0-canary22
  • Version 4.0.0-canary23
  • Version 4.0.0-canary24
  • Version 4.0.0-canary25
  • Version 4.0.0-canary26
  • Version 4.0.0-canary27
  • Version 4.0.0-canary28
  • Version 4.0.0-canary29
  • Version 4.0.0-canary30
  • Version 4.0.0-canary31
  • Version 4.0.0-canary32
  • Version 4.0.0-canary33

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-105863
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-105863