GHSA-5v66-m237-hwf7

ghsaUSosv

Payload does not invalidate JWTs after log out

view advisory published 2025-08-29Licence: CC-BY-4.0

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-4643US	—	0.40% (34th)	—	2025-08-29
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until e…

references

External citations — patches, advisories, analysis.

https://cert.pl/en/posts/2025/08/CVE-2025-4643WEB
https://github.com/payloadcms/payloadPACKAGE
https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-4643ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan