Loading...
Skip to main content
GeekWala

CVE-2026-34751 — Vulnerability in @payloadcms/graphql — CVE Details

CRITICAL

Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

Published April 1, 2026Updated April 8, 2026Source: osv

Summary

### Impact A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: - They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality. ### Patches Input validation and URL construction in the password recovery flow have been hardened. Users should upgrade to **v3.79.1** or later. ### Workarounds There are no complete workarounds. Upgrading to **v3.79.1** is recommended.

Advisory Timeline

  • First published April 1, 2026 (194 days ago).
  • Last revised April 8, 2026 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update @payloadcms/graphql to 3.79.1 or later
npm install @payloadcms/graphql@3.79.1
npm
Update payload to 3.79.1 or later
npm install payload@3.79.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: npm (2).

PackageEcosystemAffectedFixed In
@payloadcms/graphql
npm
All versions3.79.1
payload
npm
All versions3.79.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-34751?
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-34751?
CVE-2026-34751 affects @payloadcms/graphql and payload. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34751 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-hp5w-3hxx-vmwf

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies