Payload CMS Session Fixation Vulnerability in SQLite Adapter

A session fixation vulnerability has been identified in Payload CMS's SQLite adapter, affecting all versions prior to 3.44.0. The issue arises from the reuse of identifiers during account creation, allowing an attacker to exploit the JSON Web Token (JWT) authentication system. An attacker could create a new account, save the associated JWT, and then delete the account without invalidating the token. Consequently, the next user to create an account would receive the same identifier, enabling the attacker to reuse the JWT and impersonate that user.

Impact

Exploitation of this vulnerability allows for session fixation, where an attacker can reuse a JWT to authenticate as another user and perform actions on their behalf.

Remediation

Users can upgrade to Payload CMS version 3.44.0 or later to address this vulnerability.