diff --git wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
index e91fce209f..a022e30e21 100644
--- wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
+++ wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php
@@ -1511,7 +1511,7 @@ protected function check_read_post_permission( $post, $request ) {
 		$has_password_filter = false;
 
 		// Only check password if a specific post was queried for or a single comment
-		$requested_post = ! empty( $request['post'] ) && 1 === count( $request['post'] );
+		$requested_post = ! empty( $request['post'] ) && ( !is_array( $request['post'] ) || 1 === count( $request['post'] ) );
 		$requested_comment = ! empty( $request['id'] );
 		if ( ( $requested_post || $requested_comment ) && $posts_controller->can_access_password_content( $post, $request ) ) {
 			add_filter( 'post_password_required', '__return_false' );