CVE-2026-105804

UNKNOWN 0.0

Payload: Password hashes use insufficient PBKDF2 iterations

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CWE	CWE-916
Vendor	payloadcms
Product	payload
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for payloadcms payload

Be the first to know when new unknown vulnerabilities affecting payloadcms payload are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

payloadcms / payload

>= 3.0.0, < 3.90.0 >= 4.0.0-canary.0, < 4.0.0-canary.34

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm github.com: https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01 github.com: https://github.com/payloadcms/payload/releases/tag/v3.90.0