GHSA-hp5w-3hxx-vmwf
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | payload | < 3.79.1 | 3.79.1 |
| npm | @payloadcms/graphql | < 3.79.1 | 3.79.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.
Users are affected if:
- They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality.
### Patches
Input validation and URL construction in the password recovery flow have been hardened.
Users should upgrade to **v3.79.1** or later.
### Workarounds
There are no complete workarounds. Upgrading to **v3.79.1** is recommended.
References
External links from the advisory. They lead to third-party sites.