payloadcms/payload · Security
Payload: Password hashes use insufficient PBKDF2 iterations
- GHSA ID
- GHSA-q6mq-ch85-c8mm
- CVE ID
- CVE-2026-105804
- Severity
- medium
- Published
- Updated
- CVSS v4
- 5.7 · CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Description
Impact
The password-hashing configuration used a lower work factor than what is recommended.
Patches
Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.
CWEs
- CWE-916 · Use of Password Hash With Insufficient Computational Effort