Payload: Token refresh and password reset responses may expose restricted user fields

Description

Token refresh and password reset responses could return fields that the requesting user did not have access to.

Recommendation

Update the payload package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34

  >= 3.0.0, < 3.90.0**

• Patched version(s): **4.0.0-canary.34

  3.90.0**

References

• GHSA-xgv3-crq2-6f69
• CVE-2026-105853
• CWE-200
• CAPEC-310