EUVD-2026-17991
GHSA-hp5w-3hxx-vmwf
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Description
### Impact A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: - They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality. ### Patches Input validation and URL construction in the password recovery flow have been hardened. Users should upgrade to **v3.79.1** or later. ### Workarounds There are no complete workarounds. Upgrading to **v3.79.1** is recommended.
Analysis
Account takeover via password reset flow in Payload CMS versions prior to 3.79.1 allows unauthenticated remote attackers to perform actions on behalf of users who initiate password recovery. The vulnerability stems from insufficient input validation and URL construction (CWE-472: External Control of Assumed-Immutable Web Parameter), enabling attackers to intercept or manipulate the password reset process without authentication. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: identify all Payload CMS instances and their versions in your environment; disable password reset functionality if operationally feasible, or restrict access to the affected endpoint by IP/network. Within 7 days: upgrade all affected Payload CMS instances to version 3.79.1 or later per vendor release notes; test password reset flow in staging before production deployment. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today