PT-2026-29581 · Pyload · Pyload

Wsk3R · Published 2026-04-01 · Updated 2026-04-03 · CVE-2026-34751

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.79.1

Description A flaw exists in the password recovery process that could allow an unauthenticated attacker to act on behalf of a user initiating a password reset. The issue affects users utilizing Payload versions prior to 3.79.1 with authentication-enabled collections using the built-in forgot-password functionality.

Recommendations Upgrade to version 3.79.1 or later.

Fix

Weakness Enumeration

CWE-640

CWE-472

Related Identifiers

CVE-2026-34751

GHSA-HP5W-3HXX-VMWF

Affected Products

Pyload

References · 13

• https://github.com/payloadcms/payload/security/advisories/GHSA-hp5w-3hxx-vmwf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hp5w-3hxx-vmwf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34751 · Security Note
• https://github.com/payloadcms/payload/releases/tag/v3.79.1 · Note
• https://github.com/payloadcms/payload · Note
• https://twitter.com/TheHackerWire/status/2039602656797413592 · Twitter Post
• https://twitter.com/cyberbivash/status/2039438377053802950 · Twitter Post
• https://twitter.com/CVEnew/status/2039744379062018495 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040079172752576754 · Twitter Post
• https://twitter.com/infoflowcloud/status/2039746728820105675 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039404786823450985 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2040083652244324397 · Twitter Post
• https://twitter.com/CveFindCom/status/2039670564407607807 · Twitter Post