GHSA-q6mq-ch85-c8mm
Payload: Password hashes use insufficient PBKDF2 iterations
At a glance
- Published
- Updated
- CVE
- CVE-2026-105804
- CVSS_V4
- CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Description
### Impact The password-hashing configuration used a lower work factor than what is recommended. ### Patches Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.
Affected packages
| Package | Versions |
|---|---|
| npm · payload | introduced 3.0.0, fixed 3.90.0 |
| npm · payload | introduced 4.0.0-canary.0, fixed 4.0.0-canary.34 |
References
- https://github.com/payloadcms/payload/security/advisories/GHSA-q6mq-ch85-c8mm WEB
- https://github.com/payloadcms/payload/commit/1bc76e540a10f3ec88340f40591a57dae7456d01 WEB
- https://github.com/payloadcms/payload PACKAGE
- https://github.com/payloadcms/payload/releases/tag/v3.90.0 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |