Vulnerability GHSA-xgv3-crq2-6f69
Summary
Payload: Token refresh and password reset responses may expose restricted user fields
Details
Impact
Token refresh and password reset responses could return fields that the requesting user did not have access to.
You are affected if:
- An authentication collection contains hidden or read-restricted fields.
Patches
Authentication responses now apply field access and hidden-field filtering before returning user documents. Full user documents remain available server-side for access control.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Custom authentication strategies remain responsible for filtering user documents returned through custom responses.
Workarounds
There is no complete workaround. Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
