CVE-2026-34751: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34751 is a pre-authentication account takeover vulnerability in Payload CMS caused by unvalidated input in the password recovery endpoints. An unauthenticated attacker can exploit improper URL construction and insufficient input validation in the forgot-password flow to perform actions on behalf of any user who initiates a password reset. The vulnerability affects all Payload npm packages (payload and @payloadcms/graphql) below version 3.79.1 that use any auth-enabled collection with the built-in forgot-password functionality. It was published on March 30, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Payload Security Advisory).

The root cause is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The vulnerability stems from the password recovery flow failing to adequately validate inputs that are assumed to be server-controlled — such as URL construction parameters — allowing an attacker to inject or manipulate values that influence the reset flow. Because no authentication or user interaction is required, an attacker can remotely trigger the flaw by crafting requests to the forgot-password endpoint and injecting parameters that redirect or hijack the password reset token delivery or consumption. The fix in v3.79.1 hardened both input validation and URL construction logic in the recovery flow (GitHub Advisory, Payload Security Advisory).

Successful exploitation allows an unauthenticated attacker to take over user accounts by performing unauthorized actions on behalf of any user who initiates a password reset, resulting in high confidentiality and integrity impact. Attackers could gain full access to victim accounts, read sensitive user data, modify account credentials or associated records, and potentially escalate privileges if administrative accounts are targeted. Availability is not directly impacted, but account takeover of privileged users could enable broader compromise of the Payload CMS instance and its underlying data (GitHub Advisory, Feedly).

As of the time of publication, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability requires no privileges and no user interaction from the attacker's side, though it is contingent on a legitimate user initiating a password reset. The EPSS score is approximately 0.10% (28th percentile), indicating a currently low but non-negligible probability of exploitation in the near term (GitHub Advisory). No threat actor attribution or CISA KEV catalog listing has been identified at this time.

1. Reconnaissance: Identify internet-facing Payload CMS instances (versions < 3.79.1) using tools like Shodan or Censys, or by inspecting npm package metadata. Confirm that auth-enabled collections with the built-in forgot-password functionality are active.
2. Trigger password reset: Send a request to the forgot-password endpoint (e.g., POST /api/<collection>/forgot-password) for a known or guessed user email address to initiate the password recovery flow.
3. Inject manipulated parameters: Craft the request to include externally controlled parameters (e.g., manipulated URL fields or hidden form values) that the application incorrectly treats as immutable server-side values, redirecting or hijacking the reset token delivery.
4. Intercept or control the reset token: Due to improper URL construction, the password reset link or token may be sent to an attacker-controlled destination or constructed in a way that allows the attacker to predict or reuse it.
5. Complete account takeover: Use the intercepted or manipulated reset token to set a new password for the target account, gaining full authenticated access without the original credentials (GitHub Advisory, Payload Security Advisory).

• Network: Unusual or repeated POST requests to /api/<collection>/forgot-password endpoints, especially from a single IP or with anomalous parameter values; requests containing unexpected URL or redirect parameters in the password recovery flow.
• Logs: Application logs showing password reset requests for multiple user accounts in rapid succession from the same source IP; reset token consumption events not correlated with expected user activity or originating from unexpected IP addresses.
• Application Behavior: Password changes on accounts where the legitimate user did not initiate a reset; user accounts locked out or credentials changed without user-reported action.
• Authentication Events: Successful logins immediately following password reset events from IP addresses not associated with the account owner (GitHub Advisory).

The vendor has released a patch in Payload v3.79.1, which hardens input validation and URL construction in the password recovery flow for both the payload and @payloadcms/graphql npm packages. There are no complete workarounds available — upgrading to v3.79.1 or later is the only effective remediation. Organizations should prioritize patching all instances running Payload versions below 3.79.1 that have auth-enabled collections using the built-in forgot-password functionality (Payload Security Advisory, v3.79.1 Release).

The vulnerability was credited to researcher wsk3r and published by Payload maintainer denolfe on March 30, 2026 (GitHub Advisory). Coverage appeared on The Hacker Wire and several CVE aggregator platforms shortly after disclosure (Feedly). No significant broader community controversy or vendor dispute has been noted.