CVE-2026-34749: Payload has a CSRF Protection Bypass in Authentication Flow

April 1, 2026

A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.

Consumers are affected if ALL of these are true:

Payload version < v3.79.1
serverURL is configured

References

github.com/advisories/GHSA-p6mr-xf3r-ghq4
github.com/payloadcms/payload
github.com/payloadcms/payload/releases/tag/v3.79.1
github.com/payloadcms/payload/security/advisories/GHSA-p6mr-xf3r-ghq4
nvd.nist.gov/vuln/detail/CVE-2026-34749

Code Behaviors & Features

Detect and mitigate CVE-2026-34749 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →