CVE-2026-105846: Payload CMS Auth Bypass Vulnerability

CVE-2026-105846 Overview

CVE-2026-105846 is an open redirect vulnerability [CWE-601] in Payload, a free and open source headless content management system. The flaw affects versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27. An attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. The maintainers resolved the issue in versions 3.88.0 and 4.0.0-canary.27.

Critical Impact

Attackers can abuse the authentication flow to redirect users to attacker-controlled destinations, enabling phishing campaigns and credential theft against trusted Payload CMS deployments.

Affected Products

• Payload CMS versions 3.40.0 through 3.87.x
• Payload CMS canary versions prior to 4.0.0-canary.27
• Applications built on vulnerable Payload authentication components (CreateAccountForm, LoginForm)

Discovery Timeline

• 2026-10-06 - CVE-2026-105846 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105846

Vulnerability Analysis

Payload's authentication forms accept a redirect URL parameter that controls where a user is sent after a successful login or account creation. The vulnerable code paths pass this parameter directly to the Next.js router without validating that the destination is a same-origin or allow-listed URL. As a result, an attacker who can convince a guest user to click a crafted link to the Payload authentication endpoint can force redirection to an external domain once the flow completes.

This class of weakness is tracked as URL Redirection to Untrusted Site [CWE-601]. Although the vulnerability does not grant direct access to protected resources, it allows attackers to leverage the trust of the legitimate Payload domain to stage phishing pages or deliver malicious content.

Root Cause

The root cause is missing validation of user-controllable redirect input in the login and create-account client components. The fix introduces a getSafeRedirect helper imported from payload/shared to normalize and constrain the redirect target before navigation.

Attack Vector

Exploitation requires network access to the Payload admin or auth routes and user interaction (the victim must click the crafted link). The attacker constructs a URL pointing at the vulnerable Payload instance with a redirect query parameter referencing an attacker-controlled site. After the victim authenticates, the application performs client-side navigation to the untrusted destination.

// Patch applied to examples/auth/src/app/(app)/login/LoginForm/index.tsx
 import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
+import { getSafeRedirect } from 'payload/shared'
 import React, { useCallback, useRef } from 'react'
 import { useForm } from 'react-hook-form'

Source: GitHub Commit a742140

The equivalent change was applied to examples/auth/src/app/(app)/create-account/CreateAccountForm/index.tsx. The fix wraps the redirect target with getSafeRedirect so that only safe, same-origin destinations are honored.

Detection Methods for CVE-2026-105846

Indicators of Compromise

• Inbound requests to Payload authentication routes containing redirect, redirectTo, or similar query parameters referencing external hosts.
• HTTP referrer logs showing user traffic flowing from the Payload login endpoint to unrelated external domains immediately after authentication.
• Phishing reports from users who recall authenticating against the legitimate Payload CMS instance before being prompted again on a lookalike page.

Detection Strategies

• Inspect web server and application logs for authentication requests whose redirect parameter contains a scheme (http://, https://, //) or an absolute URL pointing outside your domain.
• Instrument the auth client components to log the resolved redirect target and alert when the resolved host does not match the Payload deployment hostname.
• Correlate authentication events with outbound redirects at the proxy or CDN layer to surface anomalous destinations.

Monitoring Recommendations

• Track the installed Payload version across deployments and alert when any instance is below 3.88.0 or an affected canary release.
• Monitor dependency manifests (package.json, lockfiles) in CI for the vulnerable version range >=3.40.0 <3.88.0.
• Review phishing and brand-abuse feeds for domains that chain through your Payload authentication URL.

How to Mitigate CVE-2026-105846

Immediate Actions Required

• Upgrade Payload to version 3.88.0 or 4.0.0-canary.27 or later across all environments.
• Audit custom authentication components that mirror the shipped LoginForm and CreateAccountForm to ensure they validate redirect targets.
• Educate users and support teams to re-verify the browser address bar after authenticating with the Payload admin UI.

Patch Information

The fix is delivered in Payload 3.88.0 and 4.0.0-canary.27. See the GitHub Security Advisory GHSA-w84c-53h3-mc2g, the GitHub Release v3.88.0, and the GitHub Commit a742140 for implementation details. The patch introduces the getSafeRedirect helper from payload/shared and applies it to all redirect targets in the authentication flow.

Workarounds

• If upgrading immediately is not feasible, patch local copies of LoginForm and CreateAccountForm to validate redirect parameters against an allow-list of same-origin paths.
• Enforce a Content Security Policy that restricts navigation targets, and reject authentication requests whose redirect parameter contains an absolute URL at the reverse proxy.

# Example npm upgrade to the patched Payload release
npm install payload@3.88.0
# or for canary consumers
npm install payload@4.0.0-canary.27