GHSA-w84c-53h3-mc2g: Medium severity npm/@payloadcms/next vulnerability
Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.
Patches Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.
Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/nextto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/@payloadcms/nextto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Upgrade
Upgrade
npm/payloadto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.88.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.27 - Compensating control
Remove user-controlled redirect values from authentication flows, or restrict redirect destinations to known local paths.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the affected Payload packages are exposed when their authentication flow accepts user-controlled redirect values. A guest user can be redirected to an untrusted destination after authenticating.
What does an attacker need to exploit it?
The attacker needs to craft a redirect link and induce a guest user to use it during authentication. No attacker privileges are required, but user interaction is required.
What should we do if we cannot upgrade immediately?
Remove user-controlled redirect values from authentication flows, or restrict redirect targets to known local paths. Upgrading remains the recommended remediation.
Which versions contain the fix?
Upgrade Payload packages to version 3.88.0 or later, or to 4.0.0-canary.27 or later.