CVE-2026-34751

creationtimestamp| type| source ---|---|--- 2026-04-01 18:29:32+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mihd3wxy7w2m 2026-04-01 21:20:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mihmn3nyzl2g 2026-04-02 05:26:16+00:00| seen|...

CVE-2026-34751 Payload has Unvalidated Input in Password Recovery Endpoints

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue...

CVE-2026-34751

Payload CMS (including @payloadcms/graphql and the core payload) contains a password-recovery flow vulnerability prior to version 3.79.1 that could allow an unauthenticated attacker to act on behalf of a user initiating a password reset. The issue is rated at CVSS v3.1 base score 9.1 (CRITICAL) w...