Vulnerability · Published Aug 29, 2025 · Assigned by CERT-PL
CVE-2025-4644User Session Fixation after Account Removal in PayloadCMS
Medium 5.3
In plain English
A medium-severity session fixation in Payload from Payload CMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @payloadcms/graphql | 3.44.0 | GHSA-26rv-h2hf-3fw4 |
| npm | @payloadcms/next | 3.44.0 | GHSA-26rv-h2hf-3fw4 |
| npm | payload | 3.44.0 | GHSA-26rv-h2hf-3fw4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Payload CMS | Payload | 0 – before 3.44.0 |
Weakness: CWE-384 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://cert.pl/en/posts/2025/08/CVE-2025-4643 third-party-advisory
- https://payloadcms.com product
- https://github.com/payloadcms/payload product