CVE-2025-4643
Lack of JWT Expiration after Log Out in PayloadCMS
- State
- Published
- Severity
- 6.3 Medium
- Published
- Aug 29, 2025
- Updated
- Aug 29, 2025
- Reserved
- May 13, 2025
Description
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).
This issue has been fixed in version 3.44.0 of Payload.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-613 Insufficient Session Expiration
Affected Products
| Product | Versions |
|---|---|
PayloadPayload CMS |
|
References
- https://cert.pl/en/posts/2025/08/CVE-2025-4643third-party-advisory
- https://payloadcms.com/product
- https://github.com/payloadcms/payloadproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.