Description
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.79.1
- Patched version(s): 3.79.1
References
Could your website be exposed too?
SmartScanner can check your website for Payload has a CSRF Protection Bypass in Authentication Flow and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Qwik City has a CSRF Protection Bypass via Content-Type Header Validation - CVE-2026-25151
- SillyTavern has Authentication Bypass via SSO Header Injection - CVE-2026-44649
- OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing cre - CVE-2026-28787
- RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
You might also like:
See something that needs correcting? Let us knowUpdated April 01, 2026