The CMS contains a lockout mechanism that, without authentication, accepts an account email or username and triggers a lockout. This allows an attacker to prevent a legitimate user from signing in, effectively denying service. The flaw reflects improper authentication and lack of sufficient verification before modifying account state.

Payload CMS, versions before 3.90.0 and canary releases prior to 4.0.0-canary.34 are affected. All installations of these versions that use the local-authentication collection are vulnerable.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in KEV. The attack can be performed remotely via the public API endpoint that accepts an email or username; the attacker needs only to know an account’s identity, not credentials. By repeatedly sending requests, the attacker can lock an account and cause disruption. The risk is real for deployments that rely on that authentication mechanism and where the endpoint is exposed to the internet.