GHSA-v5gf-vpjc-pc7w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-v5gf-vpjc-pc7w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-v5gf-vpjc-pc7w/GHSA-v5gf-vpjc-pc7w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-v5gf-vpjc-pc7w
- Aliases
- Published
- 2026-10-07T20:29:04Z
- Modified
- 2026-10-07T20:45:07Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Payload: Unauthenticated account-lockout denial of service
- Details
-
Impact
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
- Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.
Applications that do not use Payload local authentication are not affected.
Patches
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to
>= 3.90.0or>= 4.0.0-canary.34. - Database specific
{ "cwe_ids": [ "CWE-307", "CWE-645" ], "github_reviewed": true, "github_reviewed_at": "2026-10-07T20:29:04Z", "nvd_published_at": "2026-10-06T17:17:22Z", "severity": "MODERATE" }- References
-
- https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w
- https://nvd.nist.gov/vuln/detail/CVE-2026-105866
- https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1
- https://github.com/payloadcms/payload
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
Affected packages
npm / payload
Package
- Name
- payload
- View open source insights on deps.dev
- Purl
- pkg:npm/payload
npm / payload
Package
- Name
- payload
- View open source insights on deps.dev
- Purl
- pkg:npm/payload