{"id":"EUVD-2026-93463","enisaUuid":"883630ed-80ca-3bd0-b30e-9ab527cd3188","description":"Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 3:23:14 PM","dateUpdated":"Oct 6, 2026, 5:40:31 PM","baseScore":5.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm\nhttps://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105804\nGHSA-q6mq-ch85-c8mm\n","assigner":"GitHub_M","epss":0.08,"enisaIdProduct":[{"id":"31ceac09-d330-35ee-b4b1-4bcae66a2ac5","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"9d4aa60b-c94f-3e6a-88ec-ae3c9bf1baaf","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"3a87ffe5-434c-3acc-a8eb-a77ad7207065","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"0ad7db34-494f-317b-b825-100f121c9bd1","vulnerability":{"id":"CVE-2026-105804","description":"Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.","datePublished":"Oct 6, 2026, 3:23:14 PM","dateUpdated":"Oct 6, 2026, 5:40:31 PM","status":"PUBLISHED","baseScore":5.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm\nhttps://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93463\n","assigner":"GitHub_M","epss":0.08,"dataProcessed":"Oct 27, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"677c5126-b416-364f-8754-a2cb421facfe","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"a52966ba-acfa-3aed-8b6c-8c7134139813","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"b783e4e7-0eff-386d-ba76-c33365a2c2c8","vendor":{"name":"payloadcms"}}]}},{"id":"101020a0-ad48-3290-8e33-080cdda979e0","vulnerability":{"id":"GHSA-q6mq-ch85-c8mm","description":"Payload: Password hashes use insufficient PBKDF2 iterations","datePublished":"Oct 6, 2026, 3:38:37 PM","dateUpdated":"Oct 6, 2026, 3:38:37 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm\nhttps://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93463\n","aliases":"GHSA-q6mq-ch85-c8mm\nCVE-2026-105804\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}