Account access after logout via reusable JWT

Insufficient session expiration in Payload before 3.44.0 allows remote attackers with a stolen JWT to retain account access after logout. The logout path deletes the client cookie but leaves the stateless signed token valid, so authentication continues to accept it until tokenExpiration, two hours by default. Exploitation requires possession of a valid token and grants only the permissions of the affected account.