| Package | Affected versions | Patched versions |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| payload | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0 | 4.0.0-canary.343.90.0 |
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
Applications that do not use Payload local authentication are not affected.
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free