CVE-2025-4643 MEDIUM

CVE-2025-4643: Lack of JWT Expiration after Log Out in PayloadCMS

Vendor Payload Cms
Product Payload
Weakness CWE-613 · Insufficient session expiration
Published August 29, 2025
Last update August 29, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.

Key dates

02Disclosure timeline

August 29, 2025 CVE published
August 29, 2025 Record updated