https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:05:01.026132+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-280244 EUVD-2026-280244 2026-10-04T15:05:01.079060+00:00 EUVD-2026-280244 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34751 fkie_cve-2026-34751 2026-10-04T15:05:01.079103+00:00

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.

 https://cve.radiocsirt.org/vuln/ghsa-hp5w-3hxx-vmwf GHSA-hp5w-3hxx-vmwf — Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery 2026-10-04T15:05:01.079150+00:00

Affected: npm: payload, npm: @payloadcms/graphql

### Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

- They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality.

### Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to **v3.79.1** or later.

### Workarounds

There are no complete workarounds. Upgrading to **v3.79.1** is recommended.