Open-source package vulnerability · npm

CVE-2026-34751: Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

criticalCVSS 3.1 9.1GHSA-hp5w-3hxx-vmwf

Impact A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: - They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality. Patches Input validation and URL construction in the password recovery flow have been hardened.

Published Apr 1, 2026 · Updated Apr 8, 2026

Affected packages

payload

Ecosystem: npm
Affected: < 3.79.1
Fixed in: 3.79.1
Check: npm ls payload

@payloadcms/graphql

Ecosystem: npm
Affected: < 3.79.1
Fixed in: 3.79.1
Check: npm ls @payloadcms/graphql

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality.

Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to v3.79.1 or later.

Workarounds

There are no complete workarounds. Upgrading to v3.79.1 is recommended.

Credited to wsk3r.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries