PT-2025-35200 · Pyload · Pyload

Arkadiusz Marta · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-4643

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.44.0

Description Payload utilizes JSON Web Tokens (JWT) for authentication. Following a user logout, the JWT is not invalidated, enabling an attacker who has obtained a valid token—through theft or interception—to reuse it until its expiration date. The default expiration date is two hours, but this duration is configurable.

Recommendations Update to version 3.44.0 or later.

Fix

Insufficient Session Expiration

Session Fixation

Weakness Enumeration

CWE-613

CWE-384

Related Identifiers

CVE-2025-4643

GHSA-26RV-H2HF-3FW4

GHSA-5V66-M237-HWF7

Affected Products

Pyload

References · 13

• https://osv.dev/vulnerability/CVE-2025-4643 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26rv-h2hf-3fw4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4644 · Security Note
• https://osv.dev/vulnerability/GHSA-5v66-m237-hwf7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4643 · Security Note
• https://github.com/payloadcms/payload · Note
• https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809 · Note
• https://twitter.com/CVEnew/status/1961396075954065507 · Twitter Post
• https://cert.pl/en/posts/2025/08/CVE-2025-4643 · Note
• https://t.me/CVEtracker/31227 · Telegram Post
• https://payloadcms.com · Note
• https://t.me/cveNotify/133906 · Telegram Post
• https://t.me/cveNotify/133907 · Telegram Post