Executive brief
Payload CMS is a popular open-source headless content management system used to build backend applications. The platform failed to invalidate authentication tokens when users logged out, meaning a stolen or intercepted token could be reused by an attacker to impersonate the user for up to 2 hours. This could allow unauthorized access to user accounts and sensitive data managed through the CMS.
Technical details
The vulnerability stems from Payload's JWT-based authentication mechanism not implementing session invalidation on logout. While Payload uses HTTP-only cookies for token storage, the underlying JWT tokens themselves were never revoked or blacklisted when a user initiated a logout. An attacker who obtained a valid JWT (through token theft, network interception, or other means) could continue using that token to authenticate until the token's expiration time, which defaults to 2 hours but is configurable. The issue affects all versions prior to 3.44.0. The fix introduces optional session management functionality (enabled by default) that tracks and validates sessions server-side, allowing true token invalidation on logout. Legacy stateless JWT authentication remains available as an opt-out feature via `collectionConfig.auth.useSessions: false`.
Affected products
- Payload CMS payload all versions before 3.44.0
- Payload CMS @payloadcms/next all versions before 3.44.0
- Payload CMS @payloadcms/graphql all versions before 3.44.0
Timeline
- 2025-08-29: disclosed: Vulnerability advisory published (GHSA-5v66-m237-hwf7)
- 2025-06-27: patched: Fix released in version 3.44.0 with auth sessions feature (commit 26d709d)