CVE-2026-105804: CWE-916: Use of Password Hash With Insufficient Computational Effort in payloadcms payload

PayloadCMS, an open source headless content management system, had a vulnerability (CWE-916) where password hashes were generated using PBKDF2 with an insufficient computational work factor. This weakness lowers the cost for an attacker to perform offline password guessing attacks if hashes are obtained. The affected versions are >=3.0.0 <3.90.0 and >=4.0.0-canary.0 <4.0.0-canary.34. The vulnerability was addressed by increasing the PBKDF2 work factor in versions 3.90.0 and 4.0.0-canary.34.

The reduced computational effort for password hash verification could allow attackers who have obtained password hashes to more efficiently perform brute-force or dictionary attacks against user passwords. This increases the risk of password compromise. There is no indication of active exploitation in the wild. The vulnerability affects the strength of password storage but does not directly lead to remote code execution or privilege escalation.

Upgrade to PayloadCMS version 3.90.0 or later, or 4.0.0-canary.34 or later, where the PBKDF2 work factor has been increased to recommended levels. Applying these updates will mitigate the vulnerability by strengthening password hash computational effort.