Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset. Users are affected if: - They are using Payload version < v3.79.1 with any auth-enabled collection using the built-in forgot-password functionality. Patches Input validation and URL construction in the password recovery flow have been hardened. Users should upgrade to v3.79.1 or later. Workarounds There are no complete workarounds. Upgrading to v3.79.1 is recommended.
Recommended action: Upgrade to 3.79.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed). This issue has been fixed in version 3.44.0 of Payload.
Recommended action: Upgrade to 3.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user. This issue has been fixed in version 3.44.0 of Payload.
Recommended action: Upgrade to 3.44.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.