Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

CRITICAL 9.1CVE-2026-34751 · GHSA-hp5w-3hxx-vmwf · Published 01/04/2026 · updated 26/10/2026

Package	Affected versions	Patched versions
payload payloadcms	`< 3.79.1`	`3.79.1`
@payloadcms/graphql npm	`< 3.79.1`	`3.79.1`
payload npm	`< 3.79.1`	`3.79.1`

Description

Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality.

Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to v3.79.1 or later.

Workarounds

There are no complete workarounds. Upgrading to v3.79.1 is recommended.

NVD description

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.

References

payloadcms/payload security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-34751 · ADVISORY
payloadcms/payload · PACKAGE
payloadcms/payload release v3.79.1 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free