CVE-2026-105866: Payload CMS Authentication Bypass Vulnerability

CVE-2026-105866 Overview

CVE-2026-105866 is a denial of service vulnerability in Payload, a free and open source headless content management system. The flaw affects versions before 3.90.0 and canary versions before 4.0.0-canary.34. An unauthenticated attacker who knows a victim's email address or username can abuse the account lockout mechanism of a local-authentication collection. Repeated failed login attempts trigger the lockout, preventing the legitimate account owner from signing in. The issue falls under improper restriction of excessive authentication attempts [CWE-307].

Critical Impact
Any unauthenticated attacker who knows a valid account identifier can lock legitimate users out of a Payload CMS instance, disrupting administrative and editorial workflows.

Affected Products

Payload CMS versions prior to 3.90.0
Payload CMS canary versions prior to 4.0.0-canary.34
Any Payload collection using local authentication

Discovery Timeline

2026-10-06 - CVE CVE-2026-105866 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105866

Vulnerability Analysis

Payload CMS supports local-authentication collections that enforce an account lockout after a configurable number of failed login attempts. The lockout mechanism was designed as a brute-force defense but can be weaponized as a denial of service primitive. Because the lockout is triggered purely by failed authentication attempts against a known identifier, no authentication state is required to invoke it.

An attacker can submit repeated login requests with intentionally invalid credentials to lock out a target user. The attacker only needs the account email address or username, which is often enumerable or publicly known for administrative accounts. The locked account cannot sign in until the lockout window expires or an administrator intervenes.

Root Cause

The root cause is the absence of a reset path that distinguishes attacker-driven lockouts from legitimate user activity. In unpatched versions, a password reset did not clear the lock state. The patch addresses this by resetting the lock when the user completes a password reset.

Attack Vector

Exploitation occurs over the network against the Payload login endpoint. No privileges, user interaction, or prior access are required. The attacker scripts repeated POST requests to the login handler with the victim's identifier and arbitrary passwords until the configured failed-attempt threshold is crossed.

typescript

// Security patch in packages/drizzle/src/updateOne.ts
// fix!: reset lock on password reset 3.x

 import { buildQuery } from './queries/buildQuery.js'
 import { selectDistinct } from './queries/selectDistinct.js'
+import { transform } from './transform/read/index.js'
+import { transformForWrite } from './transform/write/index.js'
 import { upsertRow } from './upsertRow/index.js'
+import { shouldUseOptimizedUpsertRow } from './upsertRow/shouldUseOptimizedUpsertRow.js'
 import { getPrimaryDb } from './utilities/getPrimaryDb.js'
 import { getTransaction } from './utilities/getTransaction.js'
+import { markWrite } from './utilities/readAfterWrite.js'

 export const updateOne: UpdateOne = async function updateOne(
   this: DrizzleAdapter,

Source: GitHub Commit 1c46204

Detection Methods for CVE-2026-105866

Indicators of Compromise

Repeated failed login attempts against the same account identifier from one or more source IP addresses within a short interval.
Legitimate users reporting unexpected account lockout messages without prior failed login activity on their part.
Spikes in HTTP 401 or 403 responses from the Payload authentication endpoint.

Detection Strategies

Aggregate authentication failures by target username and alert when the volume approaches the configured lockout threshold.
Correlate lockout events with password reset requests originating from the same victim account to identify abuse patterns.
Baseline normal login failure rates per collection and flag deviations.

Monitoring Recommendations

Forward Payload application logs and web server access logs to a centralized SIEM for correlation and retention.
Monitor the login endpoint for distributed attempts across multiple source IPs targeting the same username.
Track administrator-initiated unlock events and investigate those not tied to a reported user issue.

How to Mitigate CVE-2026-105866

Immediate Actions Required

Upgrade Payload CMS to version 3.90.0 or later, or canary 4.0.0-canary.34 or later.
Audit active user accounts for unexplained lockout states and reset affected accounts after verifying ownership.
Restrict access to the Payload admin login endpoint using network-layer controls where feasible.

Patch Information

The fix is available in Payload 3.90.0 and canary 4.0.0-canary.34. See the GitHub Release v3.90.0 and the GitHub Security Advisory GHSA-v5gf-vpjc-pc7w for release notes and remediation details. The patch resets the lock state when a user completes a password reset, giving legitimate users a self-service recovery path.

Workarounds

Place the Payload admin interface behind a VPN, IP allowlist, or reverse proxy enforcing authentication.
Deploy a web application firewall rule that rate-limits requests to the login endpoint by source IP and target username.
Add CAPTCHA or similar challenge in front of the login flow to raise the cost of automated lockout abuse.

bash

# Example nginx rate limit for Payload login endpoint
limit_req_zone $binary_remote_addr zone=payload_login:10m rate=5r/m;

location /api/users/login {
    limit_req zone=payload_login burst=3 nodelay;
    proxy_pass http://payload_backend;
}