GitHub Advisoryadvisory · npm

GHSA-5v66-m237-hwf7 Payload does not invalidate JWTs after log out

MEDIUM Published 2025-08-29 Modified 2025-08-29 Official page ↗
Aliases
CVE-2025-4643
Ecosystem
npm
Packages
payload, @payloadcms/next, @payloadcms/graphql
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-613
Reviewed
2025-08-29

Affected packages

• npm payload: < 3.44.0 → fixed in 3.44.0 • npm @payloadcms/next: < 3.44.0 → fixed in 3.44.0 • npm @payloadcms/graphql: < 3.44.0 → fixed in 3.44.0

Description

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2025-4643 Payload uses JSON Web Tokens (JWT) for authentication. vulnerability

References