CVE-2026-105804
Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVSS 4.0
- 5.7
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - EPSS
- 0.08% chance of exploitation in the next 30 days; higher than 0% of CVEs (scores of 2026-10-25)
- CWE
- CWE-916
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q6mq-ch85-c8mm | npm | payload | >=3.0.0 <3.90.0 | 3.90.0 |
| GHSA-q6mq-ch85-c8mm | npm | payload | >=4.0.0-canary.0 <4.0.0-canary.34 | 4.0.0-canary.34 |