MEDIUM

GHSA-5v66-m237-hwf7

Payload does not invalidate JWTs after log out

Quick fix

GHSA-5v66-m237-hwf7 — payload: upgrade to the fixed version with the command below.

npm install payload@3.44.0

Details

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).

This issue has been fixed in version 3.44.0 of Payload.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/payload

Introduced in: 0Fixed in: 3.44.0

Fixnpm install payload@3.44.0

npm/@payloadcms/next

Introduced in: 0Fixed in: 3.44.0

Fixnpm install @payloadcms/next@3.44.0

npm/@payloadcms/graphql

Introduced in: 0Fixed in: 3.44.0

Fixnpm install @payloadcms/graphql@3.44.0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4643[ADVISORY]
https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809[WEB]
https://cert.pl/en/posts/2025/08/CVE-2025-4643[WEB]
https://github.com/payloadcms/payload[PACKAGE]