https://vulnerability.circl.lu/sightings/feed 2026-10-07T23:37:57.402360+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6ecc6efb-7f6b-4a21-8cd2-1aeafeb7b032/export 2026-10-07T23:37:57.429494+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6ecc6efb-7f6b-4a21-8cd2-1aeafeb7b032", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105846", "type": "seen", "source": "https://gist.github.com/alon710/b70248a31f09f3347495336ad0e72aa1", "content": "# CVE-2026-105846: CVE-2026-105846: Open Redirect in Payload CMS via Control Character Bypass\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-10-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105846\n\n## Summary\nAn open redirect vulnerability exists in Payload CMS within its Next.js-based authentication routing components. The sanitization utility fails to properly account for control characters and ambiguous encodings, allowing unauthenticated attackers to redirect users to external malicious domains after successful authentication.\n\n## TL;DR\nPayload CMS fails to properly validate the redirect parameter on login and registration pages, enabling attackers to execute open redirects by injecting control characters into the path.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-601\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.1 (Medium)\n- **EPSS Score**: Not available\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Payload CMS (payload)\n- Payload CMS Next.js integration (@payloadcms/next)\n- **payload**: >= 3.40.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **payload**: >= 4.0.0-canary.0, < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n- **@payloadcms/next**: >= 3.31.0, < 3.88.0 (Fixed in: `3.88.0`)\n- **@payloadcms/next**: >= 4.0.0-canary.0, < 4.0.0-canary.27 (Fixed in: `4.0.0-canary.27`)\n\n## Mitigation\n\n- Upgrade Payload CMS dependencies to versions that employ the WHATWG URL API validation framework.\n- Deploy Web Application Firewall rules to detect and drop authentication requests containing control characters in query parameters.\n- Enforce strict Content Security Policy (CSP) headers to restrict form submissions and navigation destinations.\n\n**Remediation Steps:**\n1. Identify all projects running Payload CMS or @payloadcms/next.\n2. Execute the package manager update command to upgrade to version 3.88.0 or 4.0.0-canary.27.\n3. Verify the update by testing redirect parameters with injected control characters to ensure fallback handling.\n4. Audit logs for prior requests containing %09, %0a, or %0d sequences on login routes.\n\n## References\n\n- [GitHub Security Advisory GHSA-w84c-53h3-mc2g](https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g)\n- [NVD CVE-2026-105846 Portal](https://nvd.nist.gov/vuln/detail/CVE-2026-105846)\n- [Official Release Announcement (v3.88.0)](https://github.com/payloadcms/payload/releases/tag/v3.88.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105846) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-07T05:30:32.000000Z"} 2026-10-07T05:30:32+00:00