EUVD-2026-93509
GHSA-66wr-7vmr-p5jq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a non-default saveToJWT mapping to a reserved claim (AC:H) and a login with attacker-controlled field value (PR:L); claim spoofing yields full impersonation, so C/I/A High.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
AnalysisAI
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field configured with the saveToJWT option set to a Payload-reserved claim name (id, collection, email, sid, iat, or exp) can place attacker-influenced values into the authentication token issued at login, allowing spoofing of identity, email, collection, or session claims. Exploitation is gated on a non-default configuration plus attacker control over the aliased field value and a subsequent login, which is why the vendor's CVSS 4.0 score of 9.2 carries Attack Requirements Present (AT:P) and the independent assessment resolves to CVSS:3.1/AV:N/AC:H/PR:L/UI:N (high complexity, authenticated); default installations and collections that only map saveToJWT to non-reserved keys are not reachable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the affected Payload collection to be configured with a custom field whose saveToJWT option is set to a Payload-reserved authentication claim name - specifically id, collection, email, sid, iat, or exp - which is a non-default configuration (reflected by CVSS AT:P). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score is 9.2 (Critical) with a network vector (AV:N), low complexity (AC:L), and no privileges required (PR:N), but it explicitly carries Attack Requirements Present (AT:P), which is the single most important signal here: exploitation is gated on a specific non-default configuration rather than being universally reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Payload CMS to version 3.90.0 or later, which is the vendor-released patch; the fixing commit enforces the reserved JWT claim namespace and signs an authVersion: 1 marker into the token header. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Payload CMS deployments and identify any running versions after 3.0.0 and before 3.90.0, focusing on collections using the saveToJWT option with reserved claim names (id, collection, email, sid, iat, exp); review authentication logs for anomalous logins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Payload CMS (npm package `payload`) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today