CVE-2025-4643

CVE-2025-4643 describes an authentication bypass vulnerability in Payload versions prior to 3.44.0. The issue stems from the system's failure to invalidate JSON Web Tokens (JWTs) upon user logout, allowing an attacker who has stolen or intercepted a token to reuse it until its expiration, which is typically two hours. This vulnerability carries a CVSS score of 6.3 (Medium), indicating a network-based attack with high attack complexity and potential for low impact on confidentiality and integrity. The primary risk is unauthorized access to a user's session. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion has been identified. Organizations using affected Payload versions should update to 3.44.0 or later to mitigate this risk.