GHSA-hfm3-x63j-7fxp: 
JavaScript vulnerability analysis and mitigation

Summary

In adopt mode the Better Auth engine writes the provider tables (sessions, verifications, accounts, API keys, organization members and invitations) through the host's Payload collections. When a host collection has versioning enabled, every write also stores a version copy of the row. Those copies include session tokens, verification identifiers (magic-link and password-reset tokens under Better Auth's default plain storage), API key hashes and metadata. Payload's default for readVersions is Boolean(req.user). With admitAnonymous: true, a guest session counts as a user. So on a host whose adopted provider collections are versioned and declare no readVersions, any session can list those version copies through /api/<slug>/versions and GraphQL. payload-auth-link already guards this for the users collection: collections.js fills readVersions with a role-manager check. It does not do the same for the other adopted provider collections, and the doctor does not warn about versioning on them.

How hosts end up here

Apps migrating from payload-auth inherit its collection overrides. A common shape is versions: { drafts: false }, written to satisfy the drizzle adapter's config.versions.drafts access. That shape keeps versioning on, because Payload treats any truthy versions value as enabled. We found exactly this in a production app migrated with the kit.

Impact

Any session, including a free guest session when admitAnonymous is on, could read live short-lived tokens and other auth material from the version tables. Depending on token storage, that can lead to account takeover. The live tables themselves were correctly admin-only; only their version copies leaked.

Suggested fix

1. plugin: for every adopted provider collection, refuse versioning (throw at config build, or force versions: false). These rows hold secrets and nothing needs their history. At minimum, fill readVersions with the same role-manager or deny-all check users gets, and deny readVersions on the kit's own records collection, which already does.
2. migrate doctor: flag adopted provider collections with versioning on as a blocker, and point to purging existing _*_v rows.
3. docs (migrating-from-payload-auth): call out the versions: { drafts: false } trap explicitly.

Host-side mitigation we applied

We defaulted readVersions to admin-only for every collection and versioned global, purged the stored auth version rows, then set versions: false on the auth collections (their _v tables are dropped in a following release). Versions: plugin 0.18.2, provider-better-auth 0.14.2, migrate 0.14.1, Payload 3.91, Better Auth 1.7.10.