CVE-2025-4643: Payload CMS Auth Bypass Vulnerability

CVE-2025-4643 Overview

CVE-2025-4643 affects Payload, a headless content management system (CMS), which uses JSON Web Tokens (JWT) for authentication. The vulnerability stems from Payload failing to invalidate JWTs after user logout. An attacker who steals or intercepts a valid token can continue using it until the token expires. The default token lifetime is two hours, but administrators can configure longer values. The issue has been resolved in Payload version 3.44.0. This weakness is classified under CWE-613: Insufficient Session Expiration.

Critical Impact
Stolen or intercepted Payload authentication tokens remain valid after logout, allowing attackers to reuse them until the configured expiration time elapses.

Affected Products

Payload CMS versions prior to 3.44.0
Applications relying on Payload's default JWT authentication flow
Deployments with extended JWT expiration configurations

Discovery Timeline

2025-08-29 - CVE-2025-4643 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4643

Vulnerability Analysis

Payload issues signed JWTs to authenticated users and validates those tokens on subsequent requests. When a user initiates logout, the server does not add the token to a revocation list or blocklist. Any party holding the token can continue to authenticate as the user until the token's exp claim passes.

This behavior contradicts common session management expectations. Users assume that logging out terminates their session immediately. In Payload's implementation, logout only clears the client-side cookie, leaving the token cryptographically valid on the server. The default two-hour expiration window provides a meaningful reuse period for a determined attacker.

Root Cause

The root cause is insufficient session expiration, tracked as CWE-613. Payload treats JWTs as stateless bearer credentials without maintaining server-side session state or a revocation mechanism. Because JWTs are self-contained and validated using signature verification alone, logout events cannot invalidate previously issued tokens without additional infrastructure such as a token blocklist or short-lived refresh token model.

Attack Vector

Exploitation requires an attacker to first obtain a valid Payload JWT. Attackers can capture tokens through cross-site scripting (XSS), network interception on unencrypted channels, malicious browser extensions, or physical access to a workstation. Once a token is captured, the attacker can replay it against Payload API endpoints even after the legitimate user logs out. See the CERT Poland CVE Analysis for additional context on the flaw and its remediation.

Detection Methods for CVE-2025-4643

Indicators of Compromise

Successful authenticated API requests from an IP address or user agent that differs from the original login session
Continued token usage timestamps that occur after a documented logout event in application logs
Concurrent use of the same JWT jti or session identifier from geographically distinct sources

Detection Strategies

Correlate logout events with subsequent authenticated requests bearing the same token identifier
Baseline typical session durations per user and alert when a token is used well beyond expected activity windows
Deploy anomaly detection on authenticated API traffic to surface geographic or device shifts within a single token lifetime

Monitoring Recommendations

Enable verbose authentication logging in Payload to record token issuance, logout, and validation events
Forward Payload application logs to a centralized SIEM for correlation with network and endpoint telemetry
Monitor for elevated volumes of authenticated requests immediately following logout activity

How to Mitigate CVE-2025-4643

Immediate Actions Required

Upgrade all Payload deployments to version 3.44.0 or later, which addresses the JWT invalidation flaw
Inventory Payload instances across the environment and confirm patch status for each
Rotate any secrets used to sign JWTs so previously issued tokens cannot be reused

Patch Information

The vulnerability has been fixed in Payload version 3.44.0. Administrators should review release notes on the GitHub PayloadCMS Repository and coordinate deployment through their standard change management process. Additional vendor context is available on the PayloadCMS Official Website.

Workarounds

Reduce the configured JWT expiration window to minimize the reuse window for stolen tokens
Enforce HTTPS across all Payload endpoints to prevent token interception on the network
Apply strict Content Security Policy (CSP) headers to reduce XSS-based token theft risk
Require re-authentication for privileged operations regardless of active session state

bash

# Configuration example
# Update Payload to the fixed release
npm install payload@3.44.0

# Reduce JWT lifetime in payload.config.ts as a defense-in-depth measure
# users: {
#   auth: {
#     tokenExpiration: 1800, // 30 minutes
#     cookies: { secure: true, sameSite: 'Strict' }
#   }
# }