CVE-2026-34751
Payload has Unvalidated Input in Password Recovery Endpoints
Résumé
Payload has Unvalidated Input in Password Recovery Endpoints
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. This issue has been patched in version 3.79.1 for @payloadcms/graphql and payload.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com