CVE-2026-105863

Payload CMS versions after 3.0.0 and before 3.90.0 can write unintended values into the authentication token issued at login when a custom field option maps a field to a reserved authentication claim name. The condition is configuration-dependent: an attacker who can cause login under that mapping may influence claims that the application then trusts for authentication decisions. Successful abuse can affect confidentiality, integrity, and availability of the vulnerable Payload instance (CVSS 4.0 9.2), consistent with authentication bypass by spoofing and unsafe modification of dynamically chosen object attributes (CWE-290 and CWE-915). Only self-hosted or deployed Payload CMS instances in that version range with the risky field mapping are affected; the issue is fixed in 3.90.0. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Payload CMS to version 3.90.0 or later. Before and after the upgrade, review custom fields that map onto reserved authentication claim names and remove or rename any such mappings. If those mappings were present, invalidate existing sessions and reissue authentication tokens so previously issued tokens cannot retain unintended claims.