CVE-2026-105846: Payload Untrusted Redirect URL Parameter Exploit
Summary
CVE-2026-105846: Payload: Untrusted redirect URL parameter exploit. Affects payload across 2 version ranges.
>= 3.40.0, < 3.88.0
>= 4.0.0-canary.0, < 4.0.0-canary.27
Fixed in 3.88.0 or 4.0.0-canary.27, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Payload is an open-source content management system (CMS) designed for building and managing websites and applications. It provides a flexible and customizable framework for developers, allowing them to create dynamic content-driven applications. However, it is susceptible to a vulnerability that allows attackers to exploit untrusted redirect URL parameters, potentially leading to unauthorized redirection of users.
Vulnerability Detail
The vulnerability arises from the improper handling of redirect URL parameters within the authentication flow of the Payload package. An attacker can craft a malicious redirect link that, when accessed by a guest user after authentication, redirects them to an untrusted destination. This can lead to phishing attacks, data theft, or other malicious activities, as users may be misled into providing sensitive information on fraudulent sites.
How To Fix
Latest published version: 3.92.0 as of 23 Oct 2026
npm install payload@3.92.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.40.0, < 3.88.03.88.0npm install payload@3.88.0 -
>= 4.0.0-canary.0, < 4.0.0-canary.274.0.0-canary.27npm install payload@4.0.0-canary.27
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Until the upgrade is completed, it is recommended to remove user-controlled redirect values from authentication flows or restrict them to known local paths. This can be done by implementing a whitelist of allowed redirect URLs in your authentication logic.
Conclusion
The CVE-2026-105846 vulnerability in the Payload package poses a significant risk due to its potential for untrusted redirects. Users are strongly encouraged to upgrade to the patched versions to safeguard their applications. Implementing workarounds can provide temporary relief until the upgrade is completed.
See every vulnerability recorded for payload →
FAQ
The vulnerability allows attackers to exploit untrusted redirect URL parameters, potentially redirecting users to malicious sites.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to phishing attacks, data theft, and unauthorized access to sensitive information.
Yes, users should upgrade to Payload version 3.88.0 or higher, or 4.0.0-canary.27 or higher to mitigate the risk.
As a temporary measure, remove user-controlled redirect values from authentication flows or restrict them to known local paths.
References
Related vulnerabilities
Recent vulnerabilities recorded for payload.
