{"uuid": "1ee695fa-3c1b-4775-b6aa-151f6a49ce41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105804", "type": "seen", "source": "https://gist.github.com/alon710/c52a2dba732474335a8df3272884df93", "content": "# CVE-2026-105804: CVE-2026-105804: Insecure Default PBKDF2 Password Hashing Configuration in Payload CMS\n\n> **CVSS Score:** 5.7\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105804\n\n## Summary\nPayload CMS was discovered to use an insecure default configuration for its password-hashing mechanism. The system requested a 512-byte key from PBKDF2-HMAC-SHA256 with 25,000 iterations, creating a severe cryptographic asymmetry. While the defending server sequentially computed 16 blocks of key material (equivalent to 400,000 internal iterations), an offline attacker only needed to compute the first 32-byte block to verify password guesses. This allowed offline attackers to crack stolen database hashes 16 times faster than intended by the security design.\n\n## TL;DR\nPayload CMS utilized a PBKDF2 configuration that requested a 512-byte output length. Because SHA-256 produces 32-byte blocks, the server performed 16x more work than necessary, whereas offline attackers could skip 15 of those blocks to verify guesses, granting them a 16x speedup advantage.\n\n## Technical Details\n\n- **CWE ID**: CWE-916\n- **Attack Vector**: Local\n- **CVSS v4 Score**: 5.7 (Medium)\n- **EPSS Score**: Not listed\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS (payload) installations between versions 3.0.0 and 3.90.0\n- **payload**: >= 3.0.0, < 3.90.0 (Fixed in: `3.90.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.34 (Fixed in: `4.0.0-canary.34`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to patched versions immediately.\n- Enforce strict multi-factor authentication (MFA) to minimize the impact of cracked credentials.\n- Ensure robust access controls and encryption on database backups.\n\n**Remediation Steps:**\n1. Update package.json dependencies to target payload versions >= 3.90.0.\n2. Run the package manager update command (e.g., npm update payload or yarn upgrade payload).\n3. Deploy the updated application to production environments.\n4. Monitor application logs for successful opportunistic password upgrades during user sign-ins.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm)\n- [Official Release Announcement (v3.90.0)](https://github.com/payloadcms/payload/releases/tag/v3.90.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105804) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T16:30:31.000000Z"}