CVE-2026-105804: Payload CMS Auth Bypass Vulnerability

CVE-2026-105804 Overview

Payload is a free and open source headless content management system (CMS) written in TypeScript. The project uses Password-Based Key Derivation Function 2 (PBKDF2) to hash user passwords. In Payload versions 3.0.0 through 3.89.x and canary versions 4.0.0-canary.0 through 4.0.0-canary.33, the PBKDF2 iteration count is set below current recommendations. The reduced work factor lowers the computational cost of brute-forcing recovered password hashes offline. The issue is tracked under [CWE-916: Use of Password Hash With Insufficient Computational Effort] and resolved in versions 3.90.0 and 4.0.0-canary.34.

Critical Impact
An attacker who obtains the user credential database can crack passwords faster than intended, accelerating account takeover of Payload CMS administrators and editors.

Affected Products

Payload CMS versions 3.0.0 through 3.89.x
Payload CMS canary versions 4.0.0-canary.0 through 4.0.0-canary.33
Deployments using the default Payload authentication strategy with PBKDF2 password hashing

Discovery Timeline

2026-10-06 - CVE-2026-105804 published to the National Vulnerability Database (NVD)
2026-10-06 - GitHub Security Advisory GHSA-q6mq-ch85-c8mm published alongside fixed release v3.90.0
2026-10-06 - Last modified in NVD database

Technical Details for CVE-2026-105804

Vulnerability Analysis

Payload stores authentication credentials using PBKDF2, a key derivation function that applies a pseudorandom function iteratively to a password and salt. The security of PBKDF2 depends directly on the iteration count, also known as the work factor. The affected Payload releases configure PBKDF2 with an iteration count below modern guidance from the Open Web Application Security Project (OWASP) and the National Institute of Standards and Technology (NIST).

The vulnerability does not expose password hashes on its own. An attacker must first obtain the hashed credentials through a separate database compromise, backup theft, or SQL injection flaw. Once hashes are exfiltrated, the low work factor lets the attacker test candidate passwords far faster on commodity GPUs or dedicated cracking hardware. Weak or reused passwords fall quickly, and even moderately complex passwords become feasible targets.

Root Cause

The root cause is a hardcoded PBKDF2 iteration parameter that has not kept pace with hardware improvements. The fix commit 1bc76e540a10f3ec88340f40591a57dae7456d01 updates the password hashing parameters used by Payload's authentication layer and adjusts related Drizzle ORM update and upsert flows that persist credential records.

Attack Vector

Exploitation is local and offline. An attacker who already possesses the users collection, including the hash and salt fields, runs a tool such as Hashcat or John the Ripper against the recovered hashes. The low iteration count reduces the per-guess cost, enabling larger dictionary and mask attacks within a practical timeframe.

typescript

// Security patch in packages/drizzle/src/updateOne.ts
// fix: update password hashing parameters
+import type { SQL } from 'drizzle-orm'
 import type { LibSQLDatabase } from 'drizzle-orm/libsql'
 import type { UpdateOne } from 'payload'
// Source: https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01

typescript

// Security patch in packages/drizzle/src/upsertRow/index.ts
// Return type now allows null when the upsert does not produce a row
   tableName,
   upsertTarget,
   where,
-}: Args): Promise<T> => {
+}: Args): Promise<null | T> => {
   if (operation === 'create' && !data.createdAt) {
     data.createdAt = new Date().toISOString()
   }
// Source: https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01

Detection Methods for CVE-2026-105804

Indicators of Compromise

Unexpected successful logins to Payload admin accounts from new IP addresses or geographies following any suspected database exposure.
Sudden spikes in failed-then-successful authentication sequences in Payload server logs that may indicate credential-stuffing with newly cracked passwords.
Presence of Payload package versions earlier than 3.90.0 or canary builds earlier than 4.0.0-canary.34 in package.json or lockfiles.

Detection Strategies

Inventory all Payload CMS deployments and compare installed versions against the fixed releases 3.90.0 and 4.0.0-canary.34.
Audit database access logs for reads against the users collection or SQL equivalents, especially bulk exports or backup operations by non-standard accounts.
Correlate administrative actions in Payload (user creation, role changes, API key generation) with recent authentication events to catch post-crack account abuse.

Monitoring Recommendations

Enable detailed authentication logging in Payload and forward events to a centralized logging or SIEM platform for retention and alerting.
Monitor outbound data transfer volumes from database hosts to detect exfiltration of credential tables.
Alert on any configuration or dependency change that reintroduces a vulnerable Payload version into a build pipeline.

How to Mitigate CVE-2026-105804

Immediate Actions Required

Upgrade Payload CMS to version 3.90.0 or canary 4.0.0-canary.34 or later in all environments.
Force a password reset for all Payload users once the upgrade is in place so new hashes use the stronger work factor.
Rotate any API keys, session secrets, and administrative credentials that may have been exposed if a database compromise is suspected.

Patch Information

The fix is delivered in Payload v3.90.0 and canary 4.0.0-canary.34. Technical details are documented in the GitHub Security Advisory GHSA-q6mq-ch85-c8mm and the upstream commit. Upgrading alone updates the hashing parameters for newly created or updated passwords; existing hashes are only rehashed when users change or reset their password.

Workarounds

If an immediate upgrade is not possible, restrict network and operating-system access to the Payload database to the minimum set of services and administrators.
Enforce strong password policies and multi-factor authentication at the identity provider or reverse proxy to reduce the value of any cracked hash.
Review and tighten backup storage permissions so credential tables are not accessible to shared storage accounts or unencrypted media.

bash

# Upgrade Payload to the patched release
npm install payload@^3.90.0

# Verify installed version
npm ls payload

# After upgrade, require all users to reset their password
# so new hashes use the updated PBKDF2 work factor.