PT-2025-35201 · Pyload+1 · Pyload+1

Arkadiusz Marta · Published 2025-08-29 · Updated 2025-09-02 · CVE-2025-4644

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.44.0

Description A session fixation issue existed in Payload's SQLite adapter due to identifier reuse during account creation. An attacker could create an account, save its JSON Web Token (JWT), delete the account, and then reuse the JWT to authenticate as a subsequent user.

Recommendations Update to version 3.44.0 or later.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2025-4644

GHSA-26RV-H2HF-3FW4

Affected Products

Pyload

Sqlite

References · 11

• https://osv.dev/vulnerability/GHSA-26rv-h2hf-3fw4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4644 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4644 · Vendor Advisory
• https://github.com/payloadcms/payload · Note
• https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809 · Note
• https://t.me/cveNotify/133907 · Telegram Post
• https://cert.pl/en/posts/2025/08/CVE-2025-4643 · Note
• https://t.me/CVEtracker/31228 · Telegram Post
• https://payloadcms.com · Note
• https://twitter.com/CVEnew/status/1961396074733515228 · Twitter Post
• https://twitter.com/CheckmarxZero/status/1962909579022360578 · Twitter Post