https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T11:25:48.815428+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-105846 fkie_cve-2026-105846 2026-10-08T11:25:48.816755+00:00

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

 https://vulnerability.circl.lu/vuln/ghsa-w84c-53h3-mc2g GHSA-w84c-53h3-mc2g — Payload: Untrusted redirect URL parameter exploit 2026-10-08T11:25:48.816841+00:00

Affected: npm: payload, npm: @payloadcms/next

### Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.

### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`.

### Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.