4vulnerabilities
- Critical0 (0.0%)
- High1 (25.0%)
- Medium0 (0.0%)
- Moderate3 (75.0%)
- Low0 (0.0%)
payloadcms-next
Ecosystem: npm
Downloads: 4.6 Mln
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 3ModerateAffects 4 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 2 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
Vulnerabilities (4)
Known vulnerabilities affecting payloadcms-next, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-w84c-53h3-mc2g | Moderate | Payload: Untrusted redirect URL parameter exploit### Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths. |
| GitHub (opens in a new tab) | |
| GHSA-mmxc-95ch-2j7c | High | @payloadcms/next has Stored XSS in Admin Panel### Impact A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. Consumers are affected if ALL of these are true: - Payload version **< v3.78.0** - At least one collection with versions enabled - An authenticated user has `create` or `update` access to that collection ### Patches This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup |
| GitHub (opens in a new tab) | |
| GHSA-26rv-h2hf-3fw4 | Moderate | Payload's SQLite adapter Session Fixation vulnerabilityA Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload. |
| GitHub (opens in a new tab) | |
| GHSA-5v66-m237-hwf7 | Moderate | Payload does not invalidate JWTs after log outPayload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload. |
| GitHub (opens in a new tab) |
- GHSA-w84c-53h3-mc2gModeratePayload: Untrusted redirect URL parameter exploit
>= 3.31.0, < 3.88.0>= 4.0.0-canary.0, < 4.0.0-canary.27
### Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.
CVE: CVE-2026-105846
- GHSA-mmxc-95ch-2j7cHigh@payloadcms/next has Stored XSS in Admin Panel
< 3.78.0
### Impact A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. Consumers are affected if ALL of these are true: - Payload version **< v3.78.0** - At least one collection with versions enabled - An authenticated user has `create` or `update` access to that collection ### Patches This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup
CVE: CVE-2026-34748
- GHSA-26rv-h2hf-3fw4ModeratePayload's SQLite adapter Session Fixation vulnerability
< 3.44.0
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.
CVE: CVE-2025-4644
- GHSA-5v66-m237-hwf7ModeratePayload does not invalidate JWTs after log out
< 3.44.0
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.
CVE: CVE-2025-4643