CVE-2025-4644
Medium
Description
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.
SeverityMedium
CVSS5.3
Exploit probability37. percentile0.4%
ProductPayload
PublishedAug 29, 2025
First seenAug 29, 2025
Weakness typeCWE-384CWE-384
How to fix
Update
- payload3.44.0 or later
- @payloadcms/next3.44.0 or later
- @payloadcms/graphql3.44.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| payloadnpm | v < 3.44.0 | 3.44.0 |
| @payloadcms/nextnpm | v < 3.44.0 | 3.44.0 |
| @payloadcms/graphqlnpm | v < 3.44.0 | 3.44.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.