CVE-2026-105846: Payload: Untrusted redirect URL parameter exploit
Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.
Patches Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.
Other sources
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/nextto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/@payloadcms/nextto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Configuration
Remove user-controlled redirect values from authentication flows or restrict them to known local paths until upgrading.
Payload authentication flows redirect URL values = known local paths only
Event History
Frequently Asked Questions
Which deployments are affected?
Payload versions from 3.40.0 before 3.88.0 are affected, as are canary releases before 4.0.0-canary.27. The affected software entries include npm/payload, npm/@payloadcms/next, and Payload CMS.
What does an attacker need to exploit this issue?
An attacker needs to craft a redirect URL parameter and induce a guest user to use a link containing it. After that user completes authentication, the authentication flow can redirect them to an untrusted destination.
Are users exposed by default?
Exposure depends on whether authentication flows accept user-controlled redirect values. The issue occurs under certain conditions and specifically affects flows where an attacker can supply a redirect URL parameter.
What can be done before upgrading?
Remove user-controlled redirect values from authentication flows, or restrict redirect targets to known local paths. Upgrading to 3.88.0 or later, or 4.0.0-canary.27 or later for canary releases, is recommended.