Description
Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.
Recommendation
Update the @payloadcms/next package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.27 >= 3.31.0, < 3.88.0** Patched version(s): **4.0.0-canary.27 3.88.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload: Untrusted redirect URL parameter exploit and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Payload: Untrusted redirect URL parameter exploit - payload - CVE-2026-105846
- Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
- Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-azure - CVE-2026-34750
- Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location - CVE-2026-101906
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026