ByteOS Network

NVD Vulnerability Details :

CVE-2025-4643

Awaiting Analysis

Source-cvd@cert.pl

Published At-29 Aug, 2025 | 10:15

Updated At-29 Aug, 2025 | 16:24

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	6.3	MEDIUM	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Secondary

Version: 4.0

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE ID	Type	Source
CWE-613	Primary	cvd@cert.pl

CWE ID: CWE-613

Type: Primary

Source: cvd@cert.pl

References

Hyperlink	Source	Resource
https://cert.pl/en/posts/2025/08/CVE-2025-4643	cvd@cert.pl	N/A
https://github.com/payloadcms/payload	cvd@cert.pl	N/A
https://payloadcms.com	cvd@cert.pl	N/A

Hyperlink: https://cert.pl/en/posts/2025/08/CVE-2025-4643

Source: cvd@cert.pl

Resource: N/A

Hyperlink: https://github.com/payloadcms/payload

Source: cvd@cert.pl

Resource: N/A

Hyperlink: https://payloadcms.com

Source: cvd@cert.pl

Resource: N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History