CVE-2026-105863: Authentication Token Bypass in Payload CMS

CVE-2026-105863 affects Payload, a free and open source headless content management system. The vulnerability resides in the custom field module: when a field is mapped to a reserved authentication claim, the system can place unintended values into the JWT authentication token during login, potentially compromising session integrity and authentication boundaries.

The vulnerability has been assigned a CVSS score of 9.4, classified as Critical. It affects all Payload versions released after version 3.0.0 and before version 3.90.0. A patch was made available and confirmed in version 3.90.0, released prior to the CVE disclosure date of 2026-10-06. No verified public exploits are currently reported at this time.

System administrators and IT teams must update immediately to Payload 3.90.0 or a later version. In parallel, review the custom field configuration in your Payload instance to identify any mappings to reserved authentication claims; document them before updating and re-evaluate after patching. Conduct session audits after the update to detect any prior unauthorized access.