CVE-2026-34751: Critical Payload CMS Flaw Lets Attackers Hijack Any Account Without a Password

If you run a Payload CMS installation, stop reading and upgrade to version 3.79.1 now. Then come back.

CVE-2026-34751 is a critical vulnerability (CVSS 9.1) in Payload, the open-source headless CMS widely used in Next.js stacks. The flaw lives inside the password recovery flow at /api/{collection-slug}/forgot-password — an endpoint that is intentionally exposed to unauthenticated requests by design. That design decision, combined with two separate implementation bugs, creates a path to full account takeover without ever knowing the target’s password.

Two bugs, one critical outcome

The first vector is Host header injection. When Payload generates a password reset email, it builds the reset link using the incoming Host header from the HTTP request. An attacker can forge that header to point to an attacker-controlled domain. The victim clicks what looks like a legitimate reset link, their token gets captured, and the attacker owns the session. This vector requires user interaction — the victim must click the link.

The second vector is more severe because it requires nothing from the victim at all. Payload’s database adapters (MongoDB, Postgres, and SQLite) each perform partial-match queries when validating reset tokens instead of requiring exact equality. An attacker who submits the first few characters of a token has a realistic chance of passing validation and completing the reset. Combined with the polymorphic join exhaustion side-effect — where flooding the endpoint with reset requests causes a localized DoS on the auth service — an attacker can disrupt legitimate resets while iterating toward a working partial match.

What’s in scope

All Payload versions from the beginning of the 3.x line up through 3.79.0 are affected. This covers payload (npm) and @payloadcms/graphql. The 2.x line has not been assessed for this specific chain.

How to fix it

Upgrade to payload@3.79.1. The patch hardens the forgot-password endpoint in three ways: it strips and replaces the Host header with a server-side configured serverURL, switches token comparisons to constant-time exact equality, and scopes polymorphic joins properly to prevent exhaustion.

npm install payload@3.79.1
# or
bun add payload@3.79.1

If you cannot upgrade immediately, add a middleware layer that enforces a static Host header before requests reach Payload’s router, and rate-limit /api/*/forgot-password aggressively (5 req/min per IP is reasonable).

The bigger picture

Payload has seen a surge in adoption as a TypeScript-native CMS with strong Next.js integration. That popularity makes CVE-2026-34751 high-impact. The password recovery endpoint is the canonical target for account takeover in any web app — it’s often less hardened than the login flow precisely because it’s treated as a safety mechanism rather than an attack surface.

Check your version, run the upgrade, and audit your rate-limiting configuration on auth endpoints while you’re in there.