Summary
Payload: Unauthenticated account-lockout denial of service
Advisory details
Impact
An unauthenticated attacker who knows an account’s email address or username could trigger Payload’s account lockout mechanism and prevent that user from signing in.
You are affected if:
- Using an affected Payload version with an auth-enabled collection that uses local authentication and account lockout.
Applications that do not use Payload local authentication are not affected.
Patches
Successful password resets now clear the account’s lockout state. The forgot-password flow also enforces a configurable minimum interval between reset emails, which defaults to 15 seconds.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
References
- https://github.com/advisories/GHSA-v5gf-vpjc-pc7w
- https://github.com/payloadcms/payload/security/advisories/GHSA-v5gf-vpjc-pc7w
- https://nvd.nist.gov/vuln/detail/CVE-2026-105866
- https://github.com/payloadcms/payload/commit/1c46204a73a0a9f988a80c52690eee5a4ada3cf1
- https://github.com/payloadcms/payload/releases/tag/v3.90.0
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-91973
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords
- HIGHCVE-2026-91972
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
- CRITICALCVE-2026-85734
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
- MEDIUMCVE-2026-77561
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
- MEDIUMCVE-2026-56682
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
- MEDIUMCVE-2026-58271
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`