GHSA-5v66-m237-hwf7 CVE-2025-4643
Payload does not invalidate JWTs after log out
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.41%
- Chance of exploitation in the next 30 days. Higher than 35.80% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
- Available
- 3 packages have a fixed version
Description
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).
This issue has been fixed in version 3.44.0 of Payload.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @payloadcms/graphql | < 3.44.0 |
3.44.0 |
| @payloadcms/next | < 3.44.0 |
3.44.0 |
| payload | < 3.44.0 |
3.44.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@payloadcms/graphql npm → 3.44.0
- npm
npm install @payloadcms/graphql@3.44.0- yarn
yarn add @payloadcms/graphql@3.44.0- pnpm
pnpm add @payloadcms/graphql@3.44.0
@payloadcms/next npm → 3.44.0
- npm
npm install @payloadcms/next@3.44.0- yarn
yarn add @payloadcms/next@3.44.0- pnpm
pnpm add @payloadcms/next@3.44.0
payload npm → 3.44.0
- npm
npm install payload@3.44.0- yarn
yarn add payload@3.44.0- pnpm
pnpm add payload@3.44.0
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9qpg-3cf8-w33x Payload: Uploaded XML files could execute same-origin JavaScript | High | Also affects payload |
| GHSA-v5gf-vpjc-pc7w Payload: Unauthenticated account-lockout denial of service | High | Also affects payload |
| GHSA-p223-2wr2-j562 Payload: Incomplete validation during the upload file lifecycle | High | Also affects payload |
| GHSA-66wr-7vmr-p5jq Payload authentication token field handling issue | Critical | Also affects payload |
| GHSA-2pwp-2369-8fg3 Payload: Bypassed sanitization of user uploaded SVGs | High | Also affects payload |
| GHSA-pj5h-5q6c-3pfx Payload external upload trust validation issue | High | Also affects payload |
| GHSA-f7hx-52q9-hcrf Payload: Unauthorized update to collection documents | Critical | Also affects payload |
| GHSA-97rh-rhh2-7vjv Payload: Remote Code Execution through first-register | High | Also affects payload |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor