CVE-2025-4644 json
User Session Fixation after Account Removal in PayloadCMS
published last yr. modified 21d ago also GHSA-26rv-h2hf-3fw4 , EUVD-2025-26181
- cvss
- 5.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 37%
- public exploits
- 0
- none known
Summary
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user.
This issue has been fixed in version 3.44.0 of Payload.
Patch / fix
- npm payload 3.44.0
- npm @payloadcms/next 3.44.0
- npm @payloadcms/graphql 3.44.0
- Payload CMS Payload 3.44.0
Is CVE-2025-4644 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | payload | <3.44.0 |
3.44.0 |
| npm | @payloadcms/next | <3.44.0 |
3.44.0 |
| npm | @payloadcms/graphql | <3.44.0 |
3.44.0 |
Affected products
- Payload CMS Payload
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
github.com
/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809
web
-
cert.pl
/en/posts/2025/08/CVE-2025-4643
third-party-advisory, web
-
payloadcms.com
product
-
github.com
/payloadcms/payload
product, package
-
nvd.nist.gov
/vuln/detail/CVE-2025-4644
advisory
Sources
- CVE List CVE-2025-4644
- GitHub Advisory GHSA-26rv-h2hf-3fw4
- NVD CVE-2025-4644
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.