CVE-2026-105853

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.33

Description Token refresh and password reset responses can independently return hidden or read-restricted fields that the requesting user is not authorized to access. This occurs when an authentication collection contains fields marked as hidden or restricted for reading.

Recommendations Update Payload versions 3.0.0 through 3.89.9 to version 3.90.0 or later. Update Payload versions 4.0.0-canary.0 through 4.0.0-canary.33 to version 4.0.0-canary.34 or later.