{"id":"EUVD-2026-93488","enisaUuid":"22674568-4119-3610-97eb-f51ff6bb6d3b","description":"Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 4:01:30 PM","dateUpdated":"Oct 6, 2026, 5:39:36 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","aliases":"CVE-2026-105846\nGHSA-w84c-53h3-mc2g\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"3410a014-3ea9-32fe-be8b-839b2806c2fb","product":{"name":"next","vendor":{"name":"vercel"}},"product_version":"3.31.0, \u003c 3.88.0"},{"id":"3902e40c-9c4f-3980-ab1d-2f9e11975a14","product":{"name":"next","vendor":{"name":"vercel"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"8791ed0e-21d5-309b-9fe4-469f7c4030d6","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"9e13920e-8b29-3608-b160-6e049cc00dea","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.40.0, \u003c 3.88.0"}],"enisaIdVendor":[{"id":"48c34699-dba8-35d0-8fca-7783607b32c8","vendor":{"name":"payloadcms"}},{"id":"e3f7172e-cf1c-3326-9327-ad59f82e31f9","vendor":{"name":"@payloadcms"}}],"enisaIdVulnerability":[{"id":"9dbf4204-11ec-3661-a77f-2f37148099d7","vulnerability":{"id":"GHSA-w84c-53h3-mc2g","description":"Payload: Untrusted redirect URL parameter exploit","datePublished":"Oct 6, 2026, 4:09:13 PM","dateUpdated":"Oct 6, 2026, 4:09:13 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93488\n","aliases":"GHSA-w84c-53h3-mc2g\nCVE-2026-105846\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b39f616b-8b14-3db8-afc3-f406817d6ad7","vulnerability":{"id":"CVE-2026-105846","description":"Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.","datePublished":"Oct 6, 2026, 4:01:30 PM","dateUpdated":"Oct 6, 2026, 5:39:36 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g\nhttps://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a\nhttps://github.com/payloadcms/payload/releases/tag/v3.88.0\n","enisa_id":"EUVD-2026-93488\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Nov 4, 2026, 7:15:38 AM","vulnerabilityProduct":[{"id":"74833ae5-2083-3f2f-bd6b-9d8e71f1b248","product":{"name":"next","vendor":{"name":"vercel"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"},{"id":"9260f818-cf8e-3f9f-b580-bc12e0e56eb1","product":{"name":"next","vendor":{"name":"vercel"}},"product_version":"3.31.0, \u003c 3.88.0"},{"id":"b499f2e8-4e5a-3270-853b-2eb14e924164","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.40.0, \u003c 3.88.0"},{"id":"ec206ff0-f2e3-3549-afa5-089f4298328d","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.27"}],"vulnerabilityVendor":[{"id":"20e3a7e1-048e-350c-bea2-7f09d930b73c","vendor":{"name":"payloadcms"}},{"id":"88ba20e4-564e-321b-a1bc-6f6d9ff3c09f","vendor":{"name":"@payloadcms"}}]}}],"enisaIdAdvisory":[]}