GitStock

payloadcms/payload · Security

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

GHSA ID
GHSA-hp5w-3hxx-vmwf
CVE ID
CVE-2026-34751
Severity
critical
Published
Updated
CVSS
9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v3
9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

  • They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality.

Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to v3.79.1 or later.

Workarounds

There are no complete workarounds. Upgrading to v3.79.1 is recommended.

CWEs

  • CWE-472 · External Control of Assumed-Immutable Web Parameter
  • CWE-640 · Weak Password Recovery Mechanism for Forgotten Password

References

Open GitHub