{"id":"EUVD-2026-93509","enisaUuid":"0ef96a06-beff-39ff-b367-1c3182bfa92c","description":"Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.","datePublished":"Oct 6, 2026, 4:39:44 PM","dateUpdated":"Oct 9, 2026, 1:15:33 AM","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-66wr-7vmr-p5jq\nhttps://github.com/payloadcms/payload/commit/56cd5cd050a57daebf33159e41e5ff9d4a45239c\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","aliases":"CVE-2026-105863\nGHSA-66wr-7vmr-p5jq\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"370ac2ea-980f-3406-aea3-3e85f3cf6b20","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"9d4d4eba-5014-3f24-a532-429a9dcf0514","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"enisaIdVendor":[{"id":"6a0ee18d-6136-3ee1-b61e-509bc555a1ff","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"d42ab92f-96f9-3d26-b350-22c2757717c5","vulnerability":{"id":"GHSA-66wr-7vmr-p5jq","description":"Payload authentication token field handling issue","datePublished":"Oct 7, 2026, 8:28:18 PM","dateUpdated":"Oct 7, 2026, 8:28:18 PM","baseScore":0.0,"references":"https://github.com/payloadcms/payload/security/advisories/GHSA-66wr-7vmr-p5jq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105863\nhttps://github.com/payloadcms/payload/commit/56cd5cd050a57daebf33159e41e5ff9d4a45239c\nhttps://github.com/payloadcms/payload\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93509\n","aliases":"GHSA-66wr-7vmr-p5jq\nCVE-2026-105863\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 2:04:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ddd7aaca-43df-3f1f-a34c-b78f791110d2","vulnerability":{"id":"CVE-2026-105863","description":"Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.","datePublished":"Oct 6, 2026, 4:39:44 PM","dateUpdated":"Oct 9, 2026, 1:15:33 AM","status":"PUBLISHED","baseScore":9.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-66wr-7vmr-p5jq\nhttps://github.com/payloadcms/payload/commit/56cd5cd050a57daebf33159e41e5ff9d4a45239c\nhttps://github.com/payloadcms/payload/releases/tag/v3.90.0\n","enisa_id":"EUVD-2026-93509\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Nov 8, 2026, 7:16:13 AM","vulnerabilityProduct":[{"id":"32440e8e-aa20-38ce-8119-453cc6c40743","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"3.0.0, \u003c 3.90.0"},{"id":"df52a34c-f882-3b77-a069-6fd5557f1ee8","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"4.0.0-canary.0, \u003c 4.0.0-canary.34"}],"vulnerabilityVendor":[{"id":"69afbf77-63a8-362e-a87d-eb49a9ac4a53","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}