EUVD-2026-93463
GHSA-q6mq-ch85-c8mm
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires prior privileged access to exfiltrated hash data for an offline attack, so AV:L/PR:H/AC:H; cracked credentials expose confidentiality (C:H) with no direct availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
AnalysisAI
Payload CMS (npm package payload) versions 3.0.0 through 3.89.x and 4.0.0-canary builds before canary.34 hash account passwords with a PBKDF2 work factor below current recommendations, so anyone who obtains a database dump or backup can test candidate passwords against the stored hashes at materially lower computational cost. The weakness sits behind stored credentials rather than in the request path: it cannot be triggered against a live instance, grants no authentication bypass, and requires the attacker to already have read access to the hash store. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to FIRST possess the stored password hashes - i.e., read access to the Payload database, a database dump, or a backup - because the weakness only reduces the offline cracking cost of PBKDF2-SHA256 hashes already in hand. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a defense-in-depth cryptographic weakness (CWE-916), not a directly exploitable flaw, and the signals consistently point to low real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the `payload` dependency to version 3.90.0 or later on the stable train, or to 4.0.0-canary.34 or later on the canary train - advisory GHSA-q6mq-ch85-c8mm specifies these as the patched releases, and the upstream commit is 1bc76e540a10f3ec88340f40591a57dae7456d01. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbit
Prototype pollution in Payload CMS's @payloadcms/plugin-import-export module lets an unauthenticated remote attacker sub
Malformed multipart request bodies sent to Payload CMS versions 3.0.0 through 3.89.x and 4.0.0-canary.0 through 4.0.0-ca
Authenticated users who can update an auth collection document in Payload CMS can change the password field on that docu
Unauthorized read access to stored form submissions and form email configuration in Payload CMS deployments running the
Payload CMS prior to 3.73.0 has a SQL injection vulnerability when querying structured data, enabling database compromis
Payload CMS releases before 3.90.0 (and canary builds before 4.0.0-canary.34) expose an orderable reorder endpoint that
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access t
Authentication claim injection in Payload CMS affects versions after 3.0.0 and before 3.90.0, where a collection field c
Duplicate order processing in @payloadcms/plugin-ecommerce allows remote, unauthenticated attackers to have a single Str
Stored Cross-Site Scripting (XSS) in Payload CMS versions prior to 3.78.0 allows authenticated users with write permissi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today