CVE-2026-34751

CRITICAL9.1EPSS 0.10%

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

Published: 4/1/2026Modified: 4/8/2026

Description

### Impact A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: - They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality. ### Patches Input validation and URL construction in the password recovery flow have been hardened. Users should upgrade to **v3.79.1** or later. ### Workarounds There are no complete workarounds. Upgrading to **v3.79.1** is recommended.

Affected packages (2)

npm/payloadfrom 0, < 3.79.1
npm/@payloadcms/graphqlfrom 0, < 3.79.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-34751
PATCHhttps://github.com/payloadcms/payload
WEBhttps://github.com/payloadcms/payload/releases/tag/v3.79.1
WEBhttps://github.com/payloadcms/payload/security/advisories/GHSA-hp5w-3hxx-vmwf