Description
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).
This issue has been fixed in version 3.44.0 of Payload.
Recommendation
Update the @payloadcms/next package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.44.0
- Patched version(s): 3.44.0
References
Could your website be exposed too?
SmartScanner can check your website for Payload does not invalidate JWTs after log out - @payloadcms/next and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Payload does not invalidate JWTs after log out - payload - CVE-2025-4643
- Payload does not invalidate JWTs after log out - CVE-2025-4643
- Payload's SQLite adapter Session Fixation vulnerability - @payloadcms/next - CVE-2025-4644
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base - CVE-2025-53892
You might also like:
See something that needs correcting? Let us knowUpdated August 29, 2025