GHSA-6244-vvv9-76f5: 
JavaScript vulnerability analysis and mitigation

Summary

GHSA-62xf-qq8f-x6w9 enforced Better Auth admin bans at the engine boundary and in the provider port: session resolution, server-side mints, API-key verification, get-session and the other Better Auth endpoints. The plugin's Payload-side gate, applyAccountControls in collections.js, is what governs users principals authenticated by other strategies. It refuses suspension (suspendedUntil) and provider-owned local credentials, but it never looks at the ban: neither plugin/dist nor core/dist references banned or banExpires. Any users principal that reaches Payload without going through the provider is therefore unaffected by a ban. Examples:

• @payloadcms/plugin-mcp keys: resolveAccessSettings sets req.user to the key owner's users document with collection: 'users' and _strategy: 'mcp-api-key'.
• Payload's own useAPIKey keys and local JWTs, on hosts that keep those strategies (break-glass operators). The same account suspended instead of banned is refused on these paths, so this is a parity gap between the two lockout mechanisms.

Impact

An admin who bans a user expects every credential of that user to stop working. A banned user's MCP API key, or a Payload API key or JWT on a host that allows them, keeps full access to whatever those credentials authorize, until the key is separately revoked.

Suggested fix

1. In requestAccountStatus / applyAccountControls, read the ban state (banned + banExpires, the same activeBanOf rule the provider uses) alongside suspendedUntil, and refuse an active ban exactly like a suspension, for every users principal regardless of _strategy.
2. Add regression tests: a banned owner's request through a non-provider strategy (an MCP-style principal, a Payload API key, a local JWT) is refused on read, update, delete, admin and readVersions; the same account with an expired ban is allowed.
3. Optionally have the doctor note that bans and suspensions both apply to non-provider credentials only from this version on. Versions: plugin 0.18.2, provider-better-auth 0.14.2, @payloadcms/plugin-mcp 3.91.0, Payload 3.91.