Payload uses a PBKDF2 work factor below recommended limits in certain releases, making hashed passwords easier to crack. The reduced computational effort shortens brute‑force attack times, thereby weakening confidentiality for user credentials. The vulnerability is classified under CWE‑916, indicating a cryptographic weakness in the hashing process.

The defect affects Payload CMS releases from 3.0.0 up to, but not including, 3.90.0 and canary builds from 4.0.0-canary.0 through 4.0.0-canary.33. Versions 3.90.0 and 4.0.0-canary.34 and later contain the fix.

The CVSS score of 5.7 reflects moderate risk. No EPSS data is available and Payload is not listed in CISA KEV, suggesting limited known exploitation. Attackers would need to obtain password hashes (e.g., from a database dump or API) before the weakened hash strength offers an advantage. Once hashes are in hand, attackers can more rapidly recover plain‑text passwords. Consequently, the primary threat is potential compromise of user accounts if hash data becomes accessible.