CVE-2025-4643 json
Lack of JWT Expiration after Log Out in PayloadCMS
published 2025-08-29 14 mo ago modified 2026-10-19 20 d ago also GHSA-5v66-m237-hwf7 , EUVD-2025-26180
- cvss
- 6.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).
This issue has been fixed in version 3.44.0 of Payload.
Patch / fix
- npm payload 3.44.0
- npm @payloadcms/next 3.44.0
- npm @payloadcms/graphql 3.44.0
- Payload CMS Payload 3.44.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | payload | <3.44.0 |
3.44.0 |
| npm | @payloadcms/next | <3.44.0 |
3.44.0 |
| npm | @payloadcms/graphql | <3.44.0 |
3.44.0 |
Affected products
- Payload CMS Payload
Classification
- Weakness
-
- CWE-613 DEPRECATED: Insufficient Session Expiration
References
-
github.com
/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809
web
-
cert.pl
/en/posts/2025/08/CVE-2025-4643
third-party-advisory, web
-
payloadcms.com
product
-
github.com
/payloadcms/payload
product, package
-
nvd.nist.gov
/vuln/detail/CVE-2025-4643
advisory
Sources
- CVE List CVE-2025-4643
- GitHub Advisory GHSA-5v66-m237-hwf7
- NVD CVE-2025-4643
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.