N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4643

CVE-2025-4643: Payload does not invalidate JWTs after log out

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).

This issue has been fixed in version 3.44.0 of Payload.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4643

CVE-2025-4643:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
payload	npm	< 3.44.0	3.44.0
@payloadcms/next	npm	< 3.44.0	3.44.0
@payloadcms/graphql	npm	< 3.44.0	3.44.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-4643, stems from the use of stateless JSON Web Tokens (JWTs) without a proper server-side invalidation mechanism upon logout. An attacker who steals a user's JWT could reuse it to access the application until the token expires, even if the legitimate user has logged out. The core issue is that logging out was purely a client-side action (deleting the token), with no corresponding action on the server to revoke the token's validity.

The patch addresses this by introducing a stateful session management system on top of JWTs. The key changes are:

Session Creation on Login: When a user logs in, a unique session ID (sid) is created, stored in the user's database record, and embedded within the JWT (loginOperation).
Server-Side Logout Invalidation: The logoutOperation function was enhanced to accept a parameter to terminate either the current session or all sessions for a user. It achieves this by deleting the corresponding session records from the database. The logout function in the @payloadcms/next package was updated to invoke this new server-side logic.
Session Validation on Authentication: The JWTAuthentication strategy, which runs on every authenticated request, was modified to not only verify the JWT's signature but also to check that the sid within the JWT corresponds to an active session in the database. If the session has been deleted (due to logout), authentication fails.

The identified vulnerable functions are the previous versions of logoutOperation, JWTAuthentication, and the Next.js logout function. These functions were modified to implement the new, more secure session-aware authentication flow, thus mitigating the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.