CVE-2026-105863 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in Payload CMS versions prior to 3.90.0 represents a critical flaw within the application's authentication and session management logic, specifically concerning how custom field configurations interact with JSON Web Token generation. Payload is widely recognized as a free and open-source headless content management system that allows developers to define flexible data structures through its schema configuration. A significant feature of this platform is the ability for administrators or developers to map specific database fields to reserved authentication claim names, such as email, username, or role identifiers, which are then embedded into the access tokens issued upon successful user login. This mapping mechanism is designed to streamline identity management by automatically populating standard JWT claims with data from the application's custom schema rather than requiring manual extraction and assignment logic in every endpoint handler.
The core technical flaw arises when a developer incorrectly maps a field that contains sensitive or unintended values to one of these reserved authentication claim names. Because the system blindly trusts the configuration mapping without sufficiently validating the nature or sensitivity of the data being placed into critical identity fields, it can result in the inclusion of arbitrary payload content within the JWT claims section. This behavior violates the principle of least privilege and proper separation of concerns between application data and security credentials. When an attacker gains access to a user account with such misconfigured permissions, they may be able to manipulate or observe these unintended values if the token is exposed through logs, client-side storage, or network interception. More critically, this flaw can facilitate identity confusion attacks where the presence of unexpected claims might confuse downstream services relying on standard JWT parsing libraries that expect specific claim structures and types.
From an operational impact perspective, this vulnerability primarily affects the integrity of user authentication sessions and potentially enables privilege escalation if the misconfigured field maps to a role or permission-based claim. If the reserved claim name corresponds to administrative roles or access levels, injecting unintended values could allow lower-privileged users to assume higher privileges by manipulating their token claims during login requests that exploit this configuration error. Additionally, because JWTs are often used for stateless authentication across microservices, any corruption of these tokens can lead to broader security failures within the distributed system architecture, including unauthorized data access or denial of service conditions if downstream services reject malformed tokens. The severity is compounded by the fact that Payload CMS is frequently deployed in production environments handling sensitive enterprise content, making robust identity management essential for maintaining overall application security posture.
This issue aligns with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration, as it involves improper handling of session credentials and potential privilege escalation through token manipulation. In the context of the MITRE ATT&CK framework, this vulnerability relates to Tactic TA0001 Initial Access and Technique T1078 Valid Accounts, where attackers leverage legitimate user accounts but exploit configuration weaknesses to expand their access scope or maintain persistence via manipulated session tokens. The flaw underscores the importance of rigorous validation in identity providers and content management systems that generate cryptographic tokens based on dynamic schema configurations.
To mitigate this vulnerability, organizations running Payload CMS versions between 3.0.0 and 3.90.0 must immediately upgrade to version 3.90.0 or later where the issue has been resolved through enhanced validation of field mappings against reserved claim names. Administrators should audit their current schema configurations to ensure that no custom fields are mapped to sensitive authentication claims unless explicitly intended and securely handled by updated logic. Furthermore, implementing strict input validation on all user-supplied data before it is persisted in database fields linked to identity tokens can provide an additional layer of defense against injection-based attacks targeting the token generation process. Regular security audits focusing on JWT implementation patterns and adherence to OWASP Authentication Cheat Sheet guidelines will help prevent similar misconfigurations in future deployments, ensuring that authentication mechanisms remain resilient against exploitation through configuration errors or data manipulation attempts.