What is GHSA-w84c-53h3-mc2g?

GHSA-w84c-53h3-mc2g is a security advisory published by GitHub Security Advisories with Medium severity. Payload: Untrusted redirect URL parameter exploit

Which CVE IDs does GHSA-w84c-53h3-mc2g cover?

GHSA-w84c-53h3-mc2g covers the following CVE IDs: CVE-2026-105846. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w84c-53h3-mc2g?

GHSA-w84c-53h3-mc2g has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-w84c-53h3-mc2g?

GHSA-w84c-53h3-mc2g affects 4 products, including: npm/payload:\u003e= 3.40.0, \u003c 3.88.0; npm/payload:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.27; npm/@payloadcms/next:\u003e= 3.31.0, \u003c 3.88.0; npm/@payloadcms/next:\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.27.

GHSA-w84c-53h3-mc2gMediumCVSS 6.1

Payload: Untrusted redirect URL parameter exploit

Vendor

GitHub Security Advisories

Published

October 6, 2026

Last Modified

October 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-105846 →

📋 Description

Impact

Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.

Patches

Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.

🎯 Affected products4

npm/payload:>= 3.40.0, < 3.88.0
npm/payload:>= 4.0.0-canary.0, < 4.0.0-canary.27
npm/@payloadcms/next:>= 3.31.0, < 3.88.0
npm/@payloadcms/next:>= 4.0.0-canary.0, < 4.0.0-canary.27

🔗 References (4)

https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g
https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a
https://github.com/payloadcms/payload/releases/tag/v3.88.0
https://github.com/advisories/GHSA-w84c-53h3-mc2g