diff --git a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java
index 48c71b21f689b5741010d204932fa68d141b559f..5485a9f8531ba36d4ecf0767b9a4d32a2eecabc9 100644
--- a/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java
+++ b/sa-token-core/src/main/java/cn/dev33/satoken/util/SaResult.java
@@ -20,6 +20,7 @@ import cn.dev33.satoken.json.SaJsonType;
 import cn.dev33.satoken.SaManager;
 
 import java.io.Serializable;
+import java.util.Iterator;
 import java.util.LinkedHashMap;
 import java.util.Map;
 
@@ -185,11 +186,13 @@ public class SaResult extends LinkedHashMap<String, Object> implements SaJsonTyp
 	 * @return 对象自身
 	 */
 	public SaResult removeNonDefaultFields() {
-		for (String key : this.keySet()) {
+		Iterator<String> iterator = this.keySet().iterator();
+		while (iterator.hasNext()) {
+			String key = iterator.next();
 			if("code".equals(key) || "msg".equals(key) || "data".equals(key)) {
 				continue;
 			}
-			this.remove(key);
+			iterator.remove();
 		}
 		return this;
 	}
diff --git a/sa-token-core/src/test/java/cn/dev33/satoken/core/util/SaResultTest.java b/sa-token-core/src/test/java/cn/dev33/satoken/core/util/SaResultTest.java
index 0d1b2731738441a28ff5345b968d467e2e1e6ecd..0b28f34c82d7d005def27d3de93e2319a003732a 100644
--- a/sa-token-core/src/test/java/cn/dev33/satoken/core/util/SaResultTest.java
+++ b/sa-token-core/src/test/java/cn/dev33/satoken/core/util/SaResultTest.java
@@ -119,6 +119,20 @@ public class SaResultTest {
 		Assertions.assertEquals(200, defaultsOnly.getCode());
 		Assertions.assertEquals("ok", defaultsOnly.getMsg());
 		Assertions.assertEquals("data", defaultsOnly.getData());
+
+		// 存在多个非默认字段时，不应抛出 ConcurrentModificationException
+		SaResult withExtras = SaResult.get(200, "ok", "data")
+				.set("extra1", "x")
+				.set("extra2", "y")
+				.set("extra3", "z");
+		withExtras.removeNonDefaultFields();
+		Assertions.assertEquals(3, withExtras.size());
+		Assertions.assertEquals(200, withExtras.getCode());
+		Assertions.assertEquals("ok", withExtras.getMsg());
+		Assertions.assertEquals("data", withExtras.getData());
+		Assertions.assertFalse(withExtras.containsKey("extra1"));
+		Assertions.assertFalse(withExtras.containsKey("extra2"));
+		Assertions.assertFalse(withExtras.containsKey("extra3"));
 	}
 
 	/** ok/data/notLogin/notPermission/empty 等静态工厂方法应返回预期状态码 */