PT-2025-35201 · Pyload +1 · Pyload +1

Arkadiusz Marta · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-4644

Positive Technologies · (AI Summary)

CVSS v4.0

5.3

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions:

Payload versions prior to 3.44.0

Description:

A session fixation issue existed in Payload's SQLite adapter due to identifier reuse during account creation. An attacker could create an account, save its JSON Web Token (JWT), delete the account, and then reuse the JWT to authenticate as a subsequent user.

Recommendations:

Update to version 3.44.0 or later.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2025-4644

Affected Products

Pyload

Sqlite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-4644 · Security Note
• https://github.com/payloadcms/payload · Note
• https://payloadcms.com · Note
• https://twitter.com/CVEnew/status/1961396074733515228 · Twitter Post
• https://cert.pl/en/posts/2025/08/CVE-2025-4643 · Note