{"id":"GHSA-q6mq-ch85-c8mm","revision":"d1992abd28bb48d3bfc9ee9ab63c1124","records":[{"revision":"d1992abd28bb48d3bfc9ee9ab63c1124","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-q6mq-ch85-c8mm","aliases":["CVE-2026-105804"],"title":"Payload: Password hashes use insufficient PBKDF2 iterations","description":"### Impact\nThe password-hashing configuration used a lower work factor than what is recommended.\n\n### Patches\nPayload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.\n\nUsers should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.\n\n### Workarounds\nUpgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.","state":0,"publishedAt":"2026-10-06T15:38:37+00:00","modifiedAt":"2026-10-06T15:46:47.6843565+00:00","affected":[{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.90.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"payload","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0-canary.0"},{"kind":"fixed","version":"4.0.0-canary.34"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm","https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01","https://github.com/payloadcms/payload","https://github.com/payloadcms/payload/releases/tag/v3.90.0"],"sourceUrl":"https://github.com/advisories/GHSA-q6mq-ch85-c8mm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q6mq-ch85-c8mm","identifiers":["GHSA-q6mq-ch85-c8mm","CVE-2026-105804"]},"retained":false,"historicalAffected":[]}],"coverage":[]}