GitHub Advisoryadvisory · npm

GHSA-hp5w-3hxx-vmwf Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

CRITICAL Published 2026-04-01 Modified 2026-04-08 Official page ↗
Aliases
CVE-2026-34751
Ecosystem
npm
Packages
payload, @payloadcms/graphql
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-472, CWE-640
Reviewed
2026-04-01

Affected packages

• npm payload: < 3.79.1 → fixed in 3.79.1 • npm @payloadcms/graphql: < 3.79.1 → fixed in 3.79.1

Description

Impact A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: • They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in `forgot-password` functionality. Patches Input validation and URL construction in the password recovery flow have been hardened. Users should upgrade to v3.79.1 or later. Workarounds There are no complete workarounds. Upgrading to v3.79.1 is recommended.

Related

Alias · CVE (1)

  • CVE-2026-34751 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (2)

  • CWE-472 External Control of Assumed-Immutable Web Parameter weakness
  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References