CVE-2026-34749
published 2026-04-01CVE-2026-34749: Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the…
PriorityP425medium5.4CVSS 3.1
AVNACLPRNUIRSUCNILAL
EPSS
0.13%
2.9th percentile
Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made. This issue has been patched in version 3.79.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| payloadcms | payload | < 3.79.1 | 3.79.1 |
| payloadcms | payload | >= 0 < 3.79.1 | 3.79.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Payload has a CSRF Protection Bypass in Authentication Flow
osv·2026-04-01
CVE-2026-34749 [MEDIUM] Payload has a CSRF Protection Bypass in Authentication Flow
Payload has a CSRF Protection Bypass in Authentication Flow
### Impact
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.
Consumers are affected if ALL of these are true:
- Payload version **< v3.79.1**
- `serverURL` is configured
### Patches
This vulnerability has been patched in **v3.79.1**. Additional validation has been added to the authentication flow.
Consumers should upgrade to **v3.79.1** or later.
### Workarounds
There is no complete workaround without upgrading.
If consumers cannot upgrade immediately, setting `cookies.sameSite` to `'Strict'` will prevent the session cookie from being sent cross-site. However, this will
GHSA
Payload has a CSRF Protection Bypass in Authentication Flow
ghsa·2026-04-01
CVE-2026-34749 [MEDIUM] CWE-352 Payload has a CSRF Protection Bypass in Authentication Flow
Payload has a CSRF Protection Bypass in Authentication Flow
### Impact
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.
Consumers are affected if ALL of these are true:
- Payload version **< v3.79.1**
- `serverURL` is configured
### Patches
This vulnerability has been patched in **v3.79.1**. Additional validation has been added to the authentication flow.
Consumers should upgrade to **v3.79.1** or later.
### Workarounds
There is no complete workaround without upgrading.
If consumers cannot upgrade immediately, setting `cookies.sameSite` to `'Strict'` will prevent the session cookie from being sent cross-site. However, this will
No detection rules found.
No public exploits indexed.
2026-04-01
Published