Description

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.

INFO

Published Date :

2025-08-29T10:01:13.697Z

Last Modified :

2025-08-29T11:53:31.892Z

Source :

CERT-PL
AFFECTED PRODUCTS

The following products are affected by CVE-2025-4644 vulnerability.

Vendors Products
Payloadcms
  • Payload
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-4644.

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability