https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T20:24:30.293687+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-280523 EUVD-2026-280523 2026-10-05T20:24:30.295738+00:00 EUVD-2026-280523 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34749 fkie_cve-2026-34749 2026-10-05T20:24:30.295768+00:00

Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.

 https://cve.radiocsirt.org/vuln/ghsa-p6mr-xf3r-ghq4 GHSA-p6mr-xf3r-ghq4 — Payload has a CSRF Protection Bypass in Authentication Flow 2026-10-05T20:24:30.295798+00:00

Affected: npm: payload

### Impact

A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.

Consumers are affected if ALL of these are true:

- Payload version **< v3.79.1** - `serverURL` is configured

### Patches

This vulnerability has been patched in **v3.79.1**. Additional validation has been added to the authentication flow.

Consumers should upgrade to **v3.79.1** or later.

### Workarounds

There is no complete workaround without upgrading.

If consumers cannot upgrade immediately, setting `cookies.sameSite` to `'Strict'` will prevent the session cookie from being sent cross-site. However, this will also require users to re-authenticate when navigating to the application from external links (e.g. email, other sites).