Redwood is vulnerable to account takeover via dbAuth "forgot-password

Description

This is an API vulnerability in Redwood’s [dbAuth], specifically the dbAuth forgot password feature:

• only projects with the dbAuth “forgot password” feature are affected
• this vulnerability was introduced in v0.38.0

Recommendation

Update the @redwoodjs/api package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0, < 3.3.1

  >= 0.38.0, < 2.2.5**

• Patched version(s): **3.3.1

  2.2.5**

References

• GHSA-3qmc-2r76-4rqp

Related Issues

• Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - CVE-2026-34751
• Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - payload - CVE-2026-34751
• StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation - CVE-2026-32103
• Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - Vulnerability

You might also like:

How do hackers hack websites?

5 Security Vulnerabilities You Can Fix Right Now

Update Cheat Sheet for Developers

Tags:

npm

@redwoodjs/api