Description
Under certain field configurations, Payload could include unintended values in the authentication token issued at login.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 >= 3.0.0, < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload authentication token field handling issue and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Payload Form Builder has an RCE issue - CVE-2026-105857
- Payload: Field access control bypass on auth collections - CVE-2026-105851
- Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - CVE-2026-34751
- Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS - CVE-2026-40171
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026