Description
Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled.
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-canary.0, < 4.0.0-canary.34 >= 3.0.0, < 3.90.0** Patched version(s): **4.0.0-canary.34 3.90.0**
References
Could your website be exposed too?
SmartScanner can check your website for Payload vulnerable to API key disclosure through ordinary document reads and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig - CVE-2026-25639
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es - CVE-2026-4800
- lodash vulnerable to Code Injection via `_.template` imports key names - CVE-2026-4800
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026