CVE-2025-4644 Overview
CVE-2025-4644 is a session fixation vulnerability in the Payload content management system's SQLite adapter. The flaw stems from identifier reuse during account creation and deletion cycles. An attacker who creates an account, captures its JSON Web Token (JWT), and then deletes the account can later reuse that token against a subsequently created user who receives the same identifier. The reused JWT authenticates the attacker as the new user, enabling actions under that account. Payload addressed the issue in version 3.44.0.
Critical Impact
An attacker can reuse a captured JWT to impersonate a future user assigned the same recycled identifier, gaining authenticated access without credentials.
Affected Products
- Payload CMS using the SQLite database adapter
- Payload versions prior to 3.44.0
- Applications built on Payload that rely on JWT-based authentication
Discovery Timeline
- 2025-08-29 - CVE-2025-4644 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4644
Vulnerability Analysis
The vulnerability is classified under [CWE-384: Session Fixation]. Payload issues JWTs bound to a user identifier assigned by the SQLite adapter. When a user account is deleted, the adapter does not invalidate previously issued JWTs, and the identifier value can be reassigned to the next newly created user. An attacker who retained a JWT from the deleted account can present that token to the authentication middleware, which validates the signature and matching identifier and grants access as the new account holder.
Root Cause
The root cause is identifier reuse combined with the absence of token revocation on account deletion. SQLite's default INTEGER PRIMARY KEY behavior can recycle row identifiers, and Payload's adapter did not track deleted account identifiers or bind tokens to a value that changes across account lifecycles, such as a per-account cryptographic secret or creation timestamp.
Attack Vector
The attack requires network access to a Payload instance that permits self-service registration. The attacker registers an account, records the returned JWT, and deletes the account through the account management interface. When another user later registers and is assigned the recycled identifier, the attacker replays the stored JWT to authenticate as that user and perform actions within their privilege scope. The vulnerability is described in the CERT.pl security advisory and tracked in the PayloadCMS repository.
Detection Methods for CVE-2025-4644
Indicators of Compromise
- JWT authentication events where the token issuance timestamp predates the target user's account creation date.
- Multiple account creation and deletion events originating from the same client IP or user agent within short intervals.
- Successful authentication from a session or device that has not completed a login flow for the current user.
Detection Strategies
- Correlate JWT iat (issued-at) claims with the referenced user's account creation timestamp; flag any token issued before the account existed.
- Alert on rapid create-delete-create patterns against the Payload authentication endpoints.
- Monitor for authenticated API calls that lack a corresponding recent login event in application logs.
Monitoring Recommendations
- Ingest Payload application and access logs into a centralized logging platform for correlation across account lifecycle events.
- Track JWT usage patterns and enforce alerting on tokens presented after account deletion events.
- Audit administrative endpoints for unexpected privilege actions performed by recently created accounts.
How to Mitigate CVE-2025-4644
Immediate Actions Required
- Upgrade Payload to version 3.44.0 or later, which contains the fix for the identifier reuse issue.
- Rotate JWT signing secrets to invalidate all outstanding tokens issued by vulnerable versions.
- Review account creation and deletion logs for suspicious patterns prior to patching.
Patch Information
Payload released the fix in version 3.44.0. Application maintainers should update the payload dependency and redeploy. Release notes and commit history are available in the PayloadCMS GitHub repository and on the PayloadCMS website.
Workarounds
- Disable self-service account registration until the upgrade is applied.
- Rotate the JWT signing secret to force reauthentication for all users and invalidate any retained tokens.
- Restrict account deletion to administrative workflows that also revoke or blocklist previously issued tokens.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
