CVE-2025-4644: Payload CMS Session Fixation in SQLite adapter

CVE-2025-4644 · Severity: medium · CVSS 4 · Published 2025-08-29

A security flaw in Payload CMS's SQLite database adapter could allow an attacker to hijack the accounts of newly registered users. By creating and then deleting an account, an attacker could obtain a security token that remains valid and is later reassigned to the next person who signs up. This allows the attacker to log in as that new user, potentially accessing their private data or performing actions on their behalf.

Technologies: @payloadcms/graphql (npm), @payloadcms/next (npm), payload (npm). Vendors: npm, Payload CMS.

Quick answers

Is CVE-2025-4644 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-4644 being exploited in the wild.
How severe is CVE-2025-4644?
Medium severity, with a CVSS score of 4, published 29 August 2025.
Which products and versions are affected?
@payloadcms/graphql (npm) SEMVER:introduced=0,fixed=3.44.0; @payloadcms/next (npm) SEMVER:introduced=0,fixed=3.44.0; payload (npm) SEMVER:introduced=0,fixed=3.44.0.
Is there a fix for CVE-2025-4644?
Yes. @payloadcms/graphql (npm): upgrade to 3.44.0 or later; @payloadcms/next (npm): upgrade to 3.44.0 or later; payload (npm): upgrade to 3.44.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-4644 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-4644?
Check whether you run @payloadcms/graphql (npm), @payloadcms/next (npm), payload (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @payloadcms/graphql (npm): upgrade to 3.44.0 or later
    npm install @payloadcms/graphql@3.44.0
  • @payloadcms/next (npm): upgrade to 3.44.0 or later
    npm install @payloadcms/next@3.44.0
  • payload (npm): upgrade to 3.44.0 or later
    npm install payload@3.44.0

Technical details

A session fixation vulnerability (CWE-384) exists in Payload CMS when configured with the SQLite adapter. The root cause is the reuse of user identifiers; when an account is deleted, its associated JSON Web Token (JWT) is not invalidated. If a new account is subsequently created and assigned the same incremental ID, the attacker—who previously controlled that ID and retained the JWT—can use the old token to authenticate as the new user. The attack requires the attacker to create and delete an account to 'prime' the identifier. This issue is resolved in version 3.44.0 by implementing more robust session management and invalidation logic.

Affected products

  • Payload CMS payload < 3.44.0
  • Payload CMS @payloadcms/next < 3.44.0
  • Payload CMS @payloadcms/graphql < 3.44.0

Identifiers

  • CVE-2025-4644
  • GHSA-26rv-h2hf-3fw4

Timeline

  • 2025-08-29: advisory: GHSA-26rv-h2hf-3fw4 published
  • 2025-08-29: disclosed: CERT.PL published advisory
  • 2025-06-27: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.