GHSA-w84c-53h3-mc2g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-w84c-53h3-mc2g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-w84c-53h3-mc2g/GHSA-w84c-53h3-mc2g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-w84c-53h3-mc2g
- Aliases
- Published
- 2026-10-06T16:09:13Z
- Modified
- 2026-10-06T16:15:05Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- Payload: Untrusted redirect URL parameter exploit
- Details
-
Impact
Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.
Patches
Users should upgrade Payload packages to
>= 3.88.0or>= 4.0.0-canary.27.Workarounds
Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.
- Database specific
{ "cwe_ids": [ "CWE-601" ], "github_reviewed": true, "github_reviewed_at": "2026-10-06T16:09:13Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
npm / payload
Package
- Name
- payload
- View open source insights on deps.dev
- Purl
- pkg:npm/payload
npm / payload
Package
- Name
- payload
- View open source insights on deps.dev
- Purl
- pkg:npm/payload
npm / @payloadcms/next
Package
- Name
- @payloadcms/next
- View open source insights on deps.dev
- Purl
- pkg:npm/%40payloadcms/next
npm / @payloadcms/next
Package
- Name
- @payloadcms/next
- View open source insights on deps.dev
- Purl
- pkg:npm/%40payloadcms/next