Payload's SQLite adapter Session Fixation vulnerability - payload

Description

A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.44.0
• Patched version(s): 3.44.0

References

• GHSA-26rv-h2hf-3fw4
• cert.pl
• CVE-2025-4644
• CWE-384
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Payload's SQLite adapter Session Fixation vulnerability - @payloadcms/next - CVE-2025-4644
• Payload's SQLite adapter Session Fixation vulnerability - CVE-2025-4644
• @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back - CVE-2025-25288
• Vuetify has a Prototype Pollution vulnerability - CVE-2025-8083

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

payload