Open RedirectAffected versions of this package are vulnerable to Open Redirect through the getSafeRedirect utility in packages/payload/src/utilities/getSafeRedirect.ts and the authentication forms in examples/auth/src/app/(app)/login/LoginForm/index.tsx and examples/auth/src/app/(app)/create-account/CreateAccountForm/index.tsx. An attacker can send a crafted redirect value to a login or account-creation flow and cause a guest user to be sent to an untrusted destination after authenticating. The vulnerable code accepts redirect input from useSearchParams() and passes it to router.push() without restricting it to a known local path, so a malicious link can steer the post-login navigation away from the intended account page. This can be used for phishing and trust abuse by making an authentication link redirect the user to an attacker-controlled site after sign-in.
Workarounds
- Remove user-controlled
redirect values from the authentication login and account-creation flows, or restrict redirect to known local paths only, so attackers cannot steer users to an untrusted destination after sign-in.
How to fix Open Redirect? Upgrade @payloadcms/next to version 3.88.0, 4.0.0-canary.27 or higher.
| >=3.31.0 <3.88.0>=4.0.0-canary.0 <4.0.0-canary.27 |
Partial String ComparisonAffected versions of this package are vulnerable to Partial String Comparison via the isPublicAdminRoute utility in packages/next/src/utilities/isPublicAdminRoute.ts, which incorrectly marks any route containing the substring /verify/ as a public admin route, regardless of whether it corresponds to a valid collection with authentication enabled. An attacker can craft a request path that includes /verify/ to bypass admin authentication checks and gain unauthorized access to protected admin routes.
How to fix Partial String Comparison? Upgrade @payloadcms/next to version 3.90.0, 4.0.0-canary.34 or higher.
| <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34 |
Overly Restrictive Account Lockout MechanismAffected versions of this package are vulnerable to Overly Restrictive Account Lockout Mechanism via the resetPassword operation, which fails to reset the account lockout state upon a successful password reset. An attacker who triggers repeated failed login attempts to lock an account can keep that account locked even after the legitimate user resets their password, causing a crash of the authentication flow for that user.
How to fix Overly Restrictive Account Lockout Mechanism? Upgrade @payloadcms/next to version 3.90.0, 4.0.0-canary.34 or higher.
| <3.90.0>=4.0.0-canary.0 <4.0.0-canary.34 |
