Payload CMS permits administrators to define custom fields that can map to authentication claim names. In any release after 3.0.0 and before 3.90.0 a misconfiguration may cause the login‑generated JWT to contain unintended values for reserved claim names. This flaw allows an attacker to forge or alter authentication tokens and obtain unauthorized access or impersonate legitimate users.

The vulnerability affects Payload CMS versions 3.0.0 through 3.89.99, specifically when custom field mappings target authentication claim names. The impact applies to all deployments using these version ranges, regardless of hosting environment.

The CVSS score of 9.2 indicates a high severity vulnerability. The EPSS score is not published, and the vulnerability is not listed in CISA KEV, suggesting no current mass exploitation. The likely attack vector is remote via the CMS administrative interface, where an attacker with sufficient privileges can create malicious field mappings that influence the token payload generated at login.