CVE-2026-105846: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in payloadcms payload

CVE-2026-105846 is an open redirect vulnerability (CWE-601) in the PayloadCMS headless content management system. In affected versions, an attacker can manipulate a redirect URL parameter to redirect guest users to arbitrary external URLs after the authentication flow, potentially facilitating phishing or other social engineering attacks. The vulnerability affects versions >=3.40.0 and <3.88.0, as well as canary releases >=4.0.0-canary.0 and <4.0.0-canary.27. The issue has been fixed in versions 3.88.0 and 4.0.0-canary.27.

An attacker can redirect users to untrusted external sites after authentication, which may lead to phishing or other social engineering attacks. The vulnerability does not allow direct compromise of the system but can be used to deceive users and potentially steal credentials or deliver malicious content. The CVSS score of 6.1 reflects a medium severity with low complexity and no privileges required, but user interaction is needed.

Upgrade to PayloadCMS version 3.88.0 or later, or 4.0.0-canary.27 or later, where this open redirect vulnerability is fixed. No other mitigation is indicated by the vendor advisory.