Description
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.
INFO
Published Date :
2025-08-29T10:01:13.697Z
Last Modified :
2025-08-29T11:53:31.892Z
Source :
CERT-PL
AFFECTED PRODUCTS
The following products are affected by CVE-2025-4644 vulnerability.
| Vendors | Products |
|---|---|
| Payloadcms |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-4644.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability