CVE-2026-34749: Payload has a CSRF Protection Bypass in Authentication Flow
Impact
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.
Consumers are affected if ALL of these are true:
- Payload version < v3.79.1 - serverURL is configured
Patches
This vulnerability has been patched in v3.79.1. Additional validation has been added to the authentication flow.
Consumers should upgrade to v3.79.1 or later.
Workarounds
There is no complete workaround without upgrading.
If consumers cannot upgrade immediately, setting cookies.sameSite to 'Strict' will prevent the session cookie from being sent cross-site. However, this will also require users to re-authenticate when navigating to the application from external links (e.g. email, other sites).
Other sources
Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34749?
CVE-2026-34749 is considered a high severity vulnerability due to its potential to bypass CSRF protection in authentication flows.
How do I fix CVE-2026-34749?
To mitigate CVE-2026-34749, upgrade to Payload version 3.79.1 or later.
What systems are affected by CVE-2026-34749?
CVE-2026-34749 affects PayloadCMS on Node.js versions prior to 3.79.1.
What are the implications of CVE-2026-34749?
CVE-2026-34749 allows attackers to make unauthorized cross-site requests, potentially compromising user accounts.
Is there a workaround for CVE-2026-34749 before upgrading?
Currently, the recommended action is to upgrade to the fixed version, as no reliable workaround is available.