Description
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Unauthenticated account-lockout denial of service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
- protobuf.js: Process-wide denial of service through unsafe option paths - CVE-2026-44290
- ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag - CVE-2026-8813
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026