CVE-2025-4643: 
JavaScript vulnerability analysis and mitigation

Payload CMS contains a vulnerability (CVE-2025-4643) related to JSON Web Token (JWT) authentication. The vulnerability was discovered and disclosed on August 29, 2025, affecting all versions of Payload before 3.44.0. The issue stems from the application's failure to invalidate JWTs after user logout (CERT Advisory).

The vulnerability is classified as Insufficient Session Expiration (CWE-613). When a user logs out, the JWT remains valid until its natural expiration time, which defaults to 2 hours but can be configured differently. The vulnerability has received a CVSS v4.0 score of 6.3 (Medium) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (NVD).

An attacker who has intercepted or stolen a JWT can continue to use it for authentication even after the legitimate user has logged out, until the token reaches its expiration time. This allows unauthorized access to user accounts and potentially sensitive information (CERT Advisory).

The vulnerability has been fixed in Payload version 3.44.0. Users are advised to upgrade to this version or later to address the security issue (Payload Github).