PT-2026-106778 · Pyload · Pyload
CVE-2026-105846
·
Published
2026-10-06
·
Updated
2026-10-06
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Payload versions 3.40.0 through 3.87.9
Payload versions prior to 4.0.0-canary.27
Description
An attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes.
Recommendations
Update Payload to version 3.88.0 or later.
Update Payload to version 4.0.0-canary.27 or later.
Remove user-controlled redirect values from authentication flows or restrict them to known local paths.
Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pyload