CVE-2026-34751: Payload has Unvalidated Input in Password Recovery Endpoints
Impact
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.
Users are affected if:
- They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality.
Patches
Input validation and URL construction in the password recovery flow have been hardened.
Users should upgrade to v3.79.1 or later.
Workarounds
There are no complete workarounds. Upgrading to v3.79.1 is recommended.
Other sources
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the impact of CVE-2026-34751?
CVE-2026-34751 allows an unauthenticated attacker to perform actions on behalf of a user during the password recovery process.
Which versions are affected by CVE-2026-34751?
CVE-2026-34751 affects Payload versions lower than 3.79.1 that are using auth-enabled collections.
How do I resolve the issue in CVE-2026-34751?
To resolve CVE-2026-34751, update to Payload version 3.79.1 or later.
What types of software are vulnerable under CVE-2026-34751?
CVE-2026-34751 affects the npm packages @payloadcms/graphql and payload, both under version 3.79.1.
Who is affected by CVE-2026-34751?
Users of Payload versions below 3.79.1 with any auth-enabled collection are vulnerable to CVE-2026-34751.