CVE-2026-105866 in Payload
Summary
by MITRE • 10/06/2026
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can abuse the account lockout mechanism of a local-authentication collection to prevent that account from signing in. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
Payload CMS, a free and open-source headless content management system built on Node.js, contains a security vulnerability related to its local authentication mechanism that allows for account lockout abuse. In versions prior to 3.90.0 and canary versions before 4.0.0-canary.34, the application fails to adequately restrict or monitor failed login attempts from unauthenticated sources when targeting specific user accounts identified by email address or username. This flaw enables an attacker who knows a valid account identifier to systematically trigger the account lockout feature without needing prior authentication credentials. By repeatedly submitting incorrect password combinations for a known target account, the attacker can exhaust the allowed number of login attempts defined in the system's configuration, thereby forcing the platform to temporarily or permanently disable access for that specific user.
This vulnerability is classified under CWE-780: Use of RSA Algorithm with OAEP Padding if it involved encryption flaws, but more accurately aligns with CWE-256: Unprotected Storage of Credentials and CWE-307: Improper Restriction of Excessive Authentication Attempts in the context of denial-of-service via account lockout mechanisms. From an ATT&CK perspective, this behavior maps to T1110: Brute Force, specifically within the sub-technique of Password Spraying or Account Lockout Evasion failures where the defender's controls are manipulated rather than bypassed. The core issue lies in the lack of rate limiting or progressive delays applied at the account level based on failed attempts from any source IP address, allowing a single attacker to disrupt service availability for legitimate users through resource exhaustion techniques inherent to lockout policies designed to prevent brute force attacks.
The operational impact of this vulnerability is primarily centered around denial-of-service against specific user accounts rather than system-wide compromise or data exfiltration. Legitimate users associated with targeted email addresses or usernames are unable to log in, which can disrupt business operations if critical administrative or editorial accounts are affected. While the attacker does not gain unauthorized access to content or modify data directly, the ability to lock out accounts undermines the availability and integrity of user management functions within the CMS. This is particularly concerning for organizations relying on Payload CMS for daily workflows where timely access to content editing tools is essential.
To mitigate this vulnerability, administrators must upgrade their Payload CMS instances to version 3.90.0 or later, which includes patches addressing these authentication flow flaws. For environments unable to immediately upgrade, implementing external rate limiting via reverse proxies such as Nginx or Apache can help restrict the frequency of login requests per IP address before they reach the application layer. Additionally, configuring CAPTCHA challenges after a small number of failed attempts can deter automated abuse without completely blocking legitimate users who may occasionally mistype passwords. Monitoring logs for repeated lockout events associated with single accounts can also aid in early detection and manual intervention during potential attacks until permanent fixes are deployed.