{"id":"EUVD-2025-26180","revision":"15a14a14f0d44fc09df6dddd90ea0245","records":[{"revision":"15a14a14f0d44fc09df6dddd90ea0245","observedAt":"2026-11-05T01:10:58.754+00:00","statement":{"source":"euvd","id":"EUVD-2025-26180","aliases":["CVE-2025-4643","GHSA-5v66-m237-hwf7"],"title":"Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can …","description":"Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). \n\nThis issue has been fixed in version 3.44.0 of Payload.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":6.3,"severity":null}],"references":["https://cert.pl/en/posts/2025/08/CVE-2025-4643","https://payloadcms.com/","https://github.com/payloadcms/payload"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26180","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 29, 2025, 10:01:09 AM","dateUpdated":"Aug 29, 2025, 11:54:27 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-26180","identifiers":["EUVD-2025-26180","CVE-2025-4643","GHSA-5v66-m237-hwf7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}