CVE-2026-21854: Js Auth Bracket Lookup Loose Equalitycve-2026-21854-js-auth-bracket-lookup-loose-equality
Authentication compares a bracket-indexed object lookup (e.g. users[username]) to a value using loose equality (==). When the bracket key originates from untrusted input, an attacker can pass "__proto__" so the lookup returns Object.prototype, which is truthy and is coerced by == to "[object Object]" — matching a chosen password and bypassing authentication.
