Payload's SQLite adapter Session Fixation vulnerability - payload - CVE-2025-4644 | SmartScanner

Description

A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

Affected version(s): < 3.44.0
Patched version(s): 3.44.0

References

GHSA-26rv-h2hf-3fw4
cert.pl
CVE-2025-4644
CWE-384
CAPEC-310
OWASP 2021-A6
OWASP 2021-A7

Could your website be exposed too?

SmartScanner can check your website for Payload's SQLite adapter Session Fixation vulnerability - payload and gives you actionable findings to investigate.

Start a free scan

Related Issues

Payload's SQLite adapter Session Fixation vulnerability - @payloadcms/next - CVE-2025-4644
Payload's SQLite adapter Session Fixation vulnerability - CVE-2025-4644
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back - CVE-2025-25288
Vuetify has a Prototype Pollution vulnerability - CVE-2025-8083

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

See something that needs correcting? Let us knowUpdated August 29, 2025