CVE-2025-4643: 
JavaScript vulnerability analysis and mitigation

CVE-2025-4643 is an Insufficient Session Expiration vulnerability in Payload CMS where JSON Web Tokens (JWTs) are not invalidated upon user logout. This allows an attacker who has stolen or intercepted a valid JWT to continue using it until the token naturally expires — by default, up to 2 hours after issuance. The vulnerability affects all versions of the payload, @payloadcms/next, and @payloadcms/graphql npm packages prior to 3.44.0. It was published and disclosed on August 29, 2025, with a fix released the same day. The CVSS v4 base score is 6.3 (Medium/Moderate) (Github Advisory, ENISA EUVD).

The root cause is classified as CWE-613 (Insufficient Session Expiration): when a user logs out of a Payload CMS instance, the server does not maintain a token denylist or otherwise revoke the issued JWT, leaving it cryptographically valid until its embedded expiry timestamp. Because JWTs are stateless by design, the server has no mechanism to distinguish a post-logout token from a legitimately active one without server-side invalidation logic. An attacker who intercepts or steals a JWT — via network sniffing, XSS, or other means — can replay it against any Payload API endpoint that accepts bearer token authentication for the full remaining lifetime of the token (default: 2 hours). The vulnerability was discovered and reported by CERT Polska (CERT-PL, Github Advisory).

Successful exploitation allows an attacker to maintain unauthorized, authenticated access to a Payload CMS instance as the logged-out user for up to 2 hours (or longer if the JWT expiry has been extended by configuration). This can result in unauthorized access to sensitive content, data exposure through the admin panel or API, and unauthorized modifications to managed content or user data. Availability is not impacted, but both confidentiality and integrity of the vulnerable system are at low risk according to the CVSS assessment (Github Advisory, ENISA EUVD).

1. Token Acquisition: Obtain a valid Payload CMS JWT by intercepting network traffic (e.g., via a man-in-the-middle attack on an unencrypted connection), exploiting an XSS vulnerability to steal the token from browser storage, or through other credential theft techniques.
2. Trigger Logout: Wait for or cause the legitimate user to log out of their Payload CMS session, which would normally be expected to invalidate the session.
3. Replay the Token: Use the captured JWT in the Authorization: Bearer <token> HTTP header to make authenticated API requests to the Payload CMS REST or GraphQL endpoints.
4. Maintain Access: Continue making authenticated requests as the logged-out user until the JWT's exp claim is reached (default: 2 hours from issuance), accessing or modifying content, user data, or administrative functions permitted by the victim's role (Github Advisory, CERT-PL).

• Network: Authenticated API requests (REST or GraphQL) to a Payload CMS instance using a JWT that was issued before a known logout event; requests originating from IP addresses different from the original authenticated session.
• Logs: Server access logs showing successful authenticated requests with a JWT bearer token after the corresponding user's logout timestamp; repeated API calls from unexpected geographic locations or user agents following a logout event.
• Application Behavior: Admin panel actions (content edits, user changes) attributed to a user account after that user has logged out, as recorded in Payload's audit/activity logs if enabled.

Upgrade to Payload CMS version 3.44.0 or later, which implements server-side JWT invalidation on logout for the payload, @payloadcms/next, and @payloadcms/graphql npm packages (Github Advisory). As a temporary workaround prior to upgrading, administrators should reduce the JWT token validity period to the shortest acceptable value in the Payload configuration to limit the exploitation window. Additionally, enforcing HTTPS to prevent token interception in transit and monitoring for anomalous authenticated API activity after logout events are recommended compensating controls (CERT-PL).

The vulnerability was discovered and reported by CERT Polska (CERT-PL), which published a dedicated advisory on August 29, 2025 (CERT-PL). The issue was also tracked by ENISA under EUVD-2025-26180 and picked up by security aggregators including Malware News and various CVE tracking platforms shortly after disclosure (ENISA EUVD). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.