Executive brief
A security flaw in Payload CMS's SQLite database adapter could allow an attacker to hijack the accounts of newly registered users. By creating and then deleting an account, an attacker could obtain a security token that remains valid and is later reassigned to the next person who signs up. This allows the attacker to log in as that new user, potentially accessing their private data or performing actions on their behalf.
Technical details
A session fixation vulnerability (CWE-384) exists in Payload CMS when configured with the SQLite adapter. The root cause is the reuse of user identifiers; when an account is deleted, its associated JSON Web Token (JWT) is not invalidated. If a new account is subsequently created and assigned the same incremental ID, the attacker—who previously controlled that ID and retained the JWT—can use the old token to authenticate as the new user. The attack requires the attacker to create and delete an account to 'prime' the identifier. This issue is resolved in version 3.44.0 by implementing more robust session management and invalidation logic.
Affected products
- Payload CMS payload < 3.44.0
- Payload CMS @payloadcms/next < 3.44.0
- Payload CMS @payloadcms/graphql < 3.44.0
Timeline
- 2025-08-29: advisory: GHSA-26rv-h2hf-3fw4 published
- 2025-08-29: disclosed: CERT.PL published advisory
- 2025-06-27: patched: Fix committed to repository