CVE-2026-34751Disclosure(payloadcms / payload)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch payloadcms payload systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.

payloadcms CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/payloadcms/payload/security/advisories/GHSA-hp5w-3hxx-vmwf

Other references

https://github.com/payloadcms/payload/releases/tag/v3.79.1

Weakness type (CWE)

CWE-472CWE-640

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

payload

Threat summary

Patch or workaround signal is available
9 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 8 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 2d ago at 4 mentions (2026-04-02); latest day: 1
9 total mentions across 4 days

Affected systems

Vendors

payloadcms

Products

payload

Deep dive

Activity timeline9 mentions / 4d

Signal classification3 categories

Disclosure

555.6%

Patch

333.3%

General

111.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-01	2	Disclosure2
2026-04-02	4	Disclosure2General1Patch1
2026-04-03	2	Disclosure1Patch1
2026-08-16	1	Patch1

Full discourse9 posts

Gray Hats@the_yellow_fall188d
Patch
Payload CMS fixes a critical 9.1 CVSS flaw (CVE-2026-34751) in its password reset flow. Attackers could hijack accounts. Update to v3.79.1 immediately! #PayloadCMS #NextJS #CVE202634751 #CyberSecurity #InfoSec #WebDev #TypeScript #ZeroTrust #PatchNow https://securityonline.info/payload-cms-password-reset-vulnerability-cve-2026-34751/ https://t.co/mPXaPDfTVB
Post summary
CVE-2026-34751 is a critical flaw in Payload CMS’s password reset flow that could enable account hijacking; the vendor recommends updating to v3.79.1 immediately to remediate the issue.
00020352
12.3K followersView on X
CyberPulse@CyberPulse5653d
Patch
‼️CRITICAL SECURITY ALERT — CVE-2026-34751 A critical authentication-bypass vulnerability, CVE-2026-34751, has been reported in Payload CMS, affecting versions prior to 3.79.1. Severity: Critical CVSS: 9.1 CWE: CWE-472 — External Control of System or Configuration Setting Affected: Payload CMS < 3.79.1 What’s the issue? The vulnerability involves improper handling of parameters during the password-recovery flow. An unauthenticated attacker may be able to manipulate recovery-related parameters and cause actions to be performed in the context of a user initiating a password reset. Potential Impact Authentication bypass Account takeover Potential compromise of administrator accounts Unauthorized access to CMS content and data No prior authentication may be required Recommended Action: Organizations running affected Payload CMS versions should upgrade to 3.79.1 or later immediately and review password-reset and authentication logs for suspicious activity. Important: Exploitability and the exact impact should be validated against the vendor’s security advisory and affected configuration before treating every deployment as compromised. #CyberSecurity #CVE202634751 #PayloadCMS #Vulnerability #CriticalVulnerability #AccountTakeover #Infosec
Post summary
The alert announces a critical authentication‑by‑pass vulnerability, CVE‑2026‑34751, in Payload CMS (<3.79.1), and urges immediate upgrade to version 3.79.1 or later to prevent account takeover.
0000098
96 followersView on X
PulsePatch.io@pulsepatchio188d
Disclosure
A critical unvalidated input vulnerability (CVE-2026-34751) affects password recovery in an unnamed product. This could lead to #accounttakeover. Review your systems for similar input validation weaknesses. #webappsec #infosec https://www.pulsepatch.io/posts/cve-2026-34751-unvalidated-input-password-recovery
Post summary
The tweet discloses CVE-2026-34751 as a critical unvalidated input issue in password recovery that could enable account takeover, but does not provide a PoC, exploit, or mitigation details.
0000034
10 followersView on X
Infoflowcloud@infoflowcloud189d
Disclosure
🚨*CVE* CVE-2026-34751 Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password reco… https://www.cve.org/CVERecord?id=CVE-2026-34751 ----- Traducción: CVE-2026-34751 Pay… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑34751 for the Payload CMS, highlighting a password‑reset vulnerability prior to v3.79.1, but does not provide PoC, exploit, patch, or active exploitation details.
0000050
65 followersView on X
CVE@CVEnew189d
General
CVE-2026-34751 Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password reco… https://www.cve.org/CVERecord?id=CVE-2026-34751
Post summary
The post references CVE-2026-34751 as a password recovery vulnerability in Payload CMS before version 3.79.1, but offers no additional technical details, PoC, or exploitation information.
00000217
56.9K followersView on X
CVEFind.com@CveFindCom189d
Patch
[CVE-2026-34751: CRITICAL] Cybersecurity alert! Vulnerability in Payload CMS identified <v3.79.1 in @payloadcms & payload could enable unauthorized access thru password reset. Update to 3.79.1 to patch.#cve,CVE-2026-34751,#cybersecurity https://cvefind.com/CVE-2026-34751
Post summary
The alert highlights a critical vulnerability in Payload CMS that allows unauthorized access through the password reset function, and it advises users to update to version 3.79.1 to apply the fix.
0000038
617 followersView on X
The Hacker Wire@TheHackerWire189d
Disclosure
🔴 CVE-2026-34751 - Critical Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow... https://www.thehackerwire.com/vulnerability/CVE-2026-34751/ https://t.co/zjIi5HcIAQ
Post summary
The post announces a critical vulnerability in the Payload CMS password recovery flow before version 3.79.1, but provides no proof of concept, exploit code, active exploitation evidence, patch information, or detailed technical description.
0000052
163 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash190d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-34751 - Payload has Unvalidated Input in Password Recovery Endpoints Intel Report: https://ift.tt/q3D4pj1
Post summary
A new vulnerability, CVE-2026-34751, involving unvalidated input in password recovery endpoints, has been reported.
0000057
281 followersView on X
0day Signal@0dayPublishing190d
Disclosure
🚨 CVE-2026-34751: Payload has Unvalidated Input in... Password reset token hijacking in Payload CMS lets attackers impersonate any user without auth - classic CWE-640 with 9... https://zerodaysignal.com/vulnerability/CVE-2026-34751 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE‑2026‑34751, a password‑reset token hijacking vulnerability in Payload CMS that allows user impersonation without authentication, but it provides only technical details without PoC, exploit, patch, or evidence of active use.
00000108
194 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	payloadcms	payload	-	node.js	-

Explore more

Back to dashboard payloadcms CVEs payload vulnerabilities

What researchers are saying

CVE-2026-34751

CyberPulse[verified]@CyberPulse56Patch

The alert announces a critical authentication‑by‑pass vulnerability, CVE‑2026‑34751, in Payload CMS (<3.79.1), and urges immediate upgrade to version 3.79.1 or later to prevent account takeover.

Gray Hats@the_yellow_fallPatch

CVE-2026-34751 is a critical flaw in Payload CMS’s password reset flow that could enable account hijacking; the vendor recommends updating to v3.79.1 immediately to remediate the issue.

PulsePatch.io@pulsepatchioDisclosure

The tweet discloses CVE-2026-34751 as a critical unvalidated input issue in password recovery that could enable account takeover, but does not provide a PoC, exploit, or mitigation details.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑34751 for the Payload CMS, highlighting a password‑reset vulnerability prior to v3.79.1, but does not provide PoC, exploit, patch, or active exploitation details.

CVE@CVEnewGeneral

The post references CVE-2026-34751 as a password recovery vulnerability in Payload CMS before version 3.79.1, but offers no additional technical details, PoC, or exploitation information.

CVEFind.com@CveFindComPatch

The alert highlights a critical vulnerability in Payload CMS that allows unauthorized access through the password reset function, and it advises users to update to version 3.79.1 to apply the fix.

The Hacker Wire@TheHackerWireDisclosure

The post announces a critical vulnerability in the Payload CMS password recovery flow before version 3.79.1, but provides no proof of concept, exploit code, active exploitation evidence, patch information, or detailed technical description.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

A new vulnerability, CVE-2026-34751, involving unvalidated input in password recovery endpoints, has been reported.