CVE-2025-4644 json
User Session Fixation after Account Removal in PayloadCMS
published 2025-08-29 14 mo ago modified 2026-10-19 20 d ago also GHSA-26rv-h2hf-3fw4 , EUVD-2025-26181
- cvss
- 5.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user.
This issue has been fixed in version 3.44.0 of Payload.
Patch / fix
- npm payload 3.44.0
- npm @payloadcms/next 3.44.0
- npm @payloadcms/graphql 3.44.0
- Payload CMS Payload 3.44.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 14 mo ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | payload | <3.44.0 |
3.44.0 |
| npm | @payloadcms/next | <3.44.0 |
3.44.0 |
| npm | @payloadcms/graphql | <3.44.0 |
3.44.0 |
Affected products
- Payload CMS Payload
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
github.com
/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809
web
-
cert.pl
/en/posts/2025/08/CVE-2025-4643
third-party-advisory, web
-
payloadcms.com
product
-
github.com
/payloadcms/payload
product, package
-
nvd.nist.gov
/vuln/detail/CVE-2025-4644
advisory
Sources
- CVE List CVE-2025-4644
- GitHub Advisory GHSA-26rv-h2hf-3fw4
- NVD CVE-2025-4644
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.