CVE-2026-105846: Payload: Untrusted redirect URL parameter exploit

October 6, 2026

Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.

References

github.com/advisories/GHSA-w84c-53h3-mc2g
github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a
github.com/payloadcms/payload/releases/tag/v3.88.0
github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g
nvd.nist.gov/vuln/detail/CVE-2026-105846

Code Behaviors & Features

Detect and mitigate CVE-2026-105846 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →