CVE-2026-105863: Payload authentication token field handling issue

Q: Which deployments are affected?

Payload versions after 3.0.0 and before 3.90.0 are affected when a custom field option maps a field to a reserved authentication claim name. Version 3.90.0 fixes the issue.

Q: What configuration condition is required for exploitation?

The affected condition is a custom field option mapped to a reserved authentication claim name. That mapping can cause unintended values to be included in authentication tokens issued at login.

Q: How can I determine whether my instance is exposed?

Check whether the deployed Payload version is greater than 3.0.0 and less than 3.90.0, then review custom field options for mappings to reserved authentication claim names. Instances without that configuration condition are not described as affected by the provided information.

Q: What is the recommended remediation?

Upgrade Payload to version 3.90.0. If an immediate upgrade is not possible, review and remove or change custom field mappings that use reserved authentication claim names.

Published Oct 6, 2026

Updated

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

Affected Software

1 affected component

Payload Payload>3.0.0<3.90.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Payload to a version that resolves this vulnerability.
Fixed in 3.90.0

Event History

Oct 6, 2026

CVE Published

via MITRE·04:39 PM

Data Sourced

via MITRE·04:39 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Payload versions after 3.0.0 and before 3.90.0 are affected when a custom field option maps a field to a reserved authentication claim name. Version 3.90.0 fixes the issue.

What configuration condition is required for exploitation?

The affected condition is a custom field option mapped to a reserved authentication claim name. That mapping can cause unintended values to be included in authentication tokens issued at login.

How can I determine whether my instance is exposed?

Check whether the deployed Payload version is greater than 3.0.0 and less than 3.90.0, then review custom field options for mappings to reserved authentication claim names. Instances without that configuration condition are not described as affected by the provided information.

What is the recommended remediation?

Upgrade Payload to version 3.90.0. If an immediate upgrade is not possible, review and remove or change custom field mappings that use reserved authentication claim names.

CVE-2026-105863: Payload authentication token field handling issue

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What configuration condition is required for exploitation?

How can I determine whether my instance is exposed?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What configuration condition is required for exploitation?

How can I determine whether my instance is exposed?

What is the recommended remediation?