Payload authentication token field handling issue

緊急 9.4CVE-2026-105863 · GHSA-66wr-7vmr-p5jq · 06/10/2026 公開 · 15/10/2026 更新

要点

CVE-2026-105863 は payload (payloadcms), payload に影響する深刻度「緊急」 (CVSS 9.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.38%（全脆弱性の 31.6% より高い）。
対処：3.90.0, 4.0.0-canary.34 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
payload payloadcms	`= 4.0.0≥ 3.0.0, < 3.90.0`	`3.90.0`
payload npm	`≥ 3.0.0, < 3.90.0≥ 4.0.0-canary.0, < 4.0.0-canary.34`	`3.90.04.0.0-canary.34`

概要

Impact

Under certain field configurations, Payload could include unintended values in the authentication token issued at login.

You are affected if:

You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name.

Patches

Payload now restricts which field configuration options can influence the contents of the authentication token.

Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

Workarounds

There is no complete workaround. Users should upgrade payload packages to >= 3.90.0 or >= 4.0.0-canary.34.

NVD の説明

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.