GHSA-66wr-7vmr-p5jq: Npm/payload vulnerability
Impact
Under certain field configurations, Payload could include unintended values in the authentication token issued at login.
You are affected if:
- You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name.
Patches Payload now restricts which field configuration options can influence the contents of the authentication token.
Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds There is no complete workaround. Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34
Event History
Frequently Asked Questions
Who is affected by this issue?
You are affected if you use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name. Deployments without that configuration are not identified as affected by the advisory.
What configuration enables exploitation?
The issue requires a custom field option configured to map a field to a reserved authentication claim name. Under those field configurations, unintended values can be included in authentication tokens issued at login.
What should teams do if they cannot patch immediately?
There is no complete workaround. Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.
How can I determine whether my deployment may already be affected?
Review custom field options for mappings to reserved authentication claim names, then compare the deployed Payload package version with the fixed versions. The advisory does not provide a method for determining whether unintended token values have already been issued.