External risk intelligence

Payload CMS Authentication Token Tampering Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-105863

Payload is a headless content management system (CMS). CMS platforms are commonly deployed as internet-facing web applications or API backends to serve content and handle authentication for front-end services, making them a common part of the public-facing web attack surface.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in certain versions of Payload, an open-source headless content management system, where a configuration error could allow unintended values into authentication tokens. This could potentially impact the integrity of user authentication processes.

Issue affects how login tokens are generated.
Leadership should track potential impacts to authentication security.
Confirm relevance to confirm exposure and any needed remediation.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach this vulnerability by targeting a headless content management system that allows custom fields. If a custom field is configured to map to a reserved authentication claim name, it could lead to the injection of unintended values into authentication tokens during the login process. This could allow an attacker to gain unauthorized access or elevate their privileges.

Requires unauthenticated network access.
Triggered by login with a specifically crafted custom field.
Risk of unauthorized token modification.

Live Threat

Current exploitation, exposure, and threat context

A security vulnerability in Payload could allow an attacker to place unintended values into authentication tokens when a user logs in, under specific conditions where a custom field is mapped to a reserved authentication claim name. This could potentially impact the integrity of user authentication.

Authentication tokens may be compromised.
Unintended values could be inserted.
User login sessions could be affected.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and platform teams are likely responsible for addressing this vulnerability in the Payload content management system. The immediate first step is to locate all instances of Payload, confirm their exposure and business criticality, and identify the specific system owners. Remediation planning should then proceed based on these findings.

Identify and confirm Payload asset ownership.
Verify external reachability and business impact.
Plan remediation or mitigation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Payload?

Payload is a free, open-source headless content management system (CMS). Developers use it as a backend platform to manage content and provide data via APIs to front-end applications, websites, or mobile services. Because it is headless, it handles core logic like user authentication independently of the user interface.

What does CVE-2026-105863 mean for security?

This vulnerability involves Authentication Bypass and Improperly Controlled Modification of Dynamically-Determined Object Attributes. In simple terms, the software allows a custom data field to overwrite sensitive authentication claims. This means a user could potentially manipulate their login token to gain unauthorized privileges or access.

How can an attacker trigger this vulnerability?

An attacker needs to interact with the login process of a system that has a specific, insecure configuration. The bug is only triggered if a custom field is intentionally mapped to a reserved authentication claim name. If no custom fields are mapped to reserved names, the login process functions normally and does not trigger this issue.

Is my instance of Payload at risk?

Halo Surface Signal indicates that Payload is often deployed as an internet-facing web application or API backend. If your instance is reachable from the public internet, it falls within the primary attack surface. You should prioritize assessing your CMS configurations to see if they match the risky mapping described.

What should I do to fix this in Payload?

The first step is to identify all running versions of Payload in your environment and determine if they are between 3.0.0 and 3.90.0. If you find affected systems, plan to update them to version 3.90.0, where this token generation flaw has been resolved by the maintainers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.