Vulnerability · Published Aug 29, 2025 · Assigned by CERT-PL
CVE-2025-4643Lack of JWT Expiration after Log Out in PayloadCMS
Medium 6.3
In plain English
A medium-severity security flaw in Payload from Payload CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @payloadcms/graphql | 3.44.0 | GHSA-5v66-m237-hwf7 |
| npm | @payloadcms/next | 3.44.0 | GHSA-5v66-m237-hwf7 |
| npm | payload | 3.44.0 | GHSA-5v66-m237-hwf7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Payload CMS | Payload | 0 – before 3.44.0 |
Weakness: CWE-613 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://cert.pl/en/posts/2025/08/CVE-2025-4643 third-party-advisory
- https://payloadcms.com product
- https://github.com/payloadcms/payload product