GitHub Advisoryadvisory · npm

GHSA-26rv-h2hf-3fw4 Payload's SQLite adapter Session Fixation vulnerability

MEDIUM Published 2025-08-29 Modified 2025-08-29 Official page ↗
Aliases
CVE-2025-4644
Ecosystem
npm
Packages
payload, @payloadcms/next, @payloadcms/graphql
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-384
Reviewed
2025-08-29

Affected packages

• npm payload: < 3.44.0 → fixed in 3.44.0 • npm @payloadcms/next: < 3.44.0 → fixed in 3.44.0 • npm @payloadcms/graphql: < 3.44.0 → fixed in 3.44.0

Description

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.

Related

Alias · CVE (1)

  • CVE-2025-4644 A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References