CVE-2026-34751
Payload has Unvalidated Input in Password Recovery Endpoints
概要
Payload has Unvalidated Input in Password Recovery Endpoints
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com