CVE-2025-4643

published 2025-08-29

CVE-2025-4643: Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to…

Priority P3 36 medium 6.3 CVSS 4.0

AV N AC H AT N PR N UI N VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).

This issue has been fixed in version 3.44.0 of Payload.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
payload_cms	payload	< 3.44.0	3.44.0
payloadcms	graphql	>= 0 < 3.44.0	3.44.0
payloadcms	next	>= 0 < 3.44.0	3.44.0
payloadcms	payload	>= 0 < 3.44.0	3.44.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-613