CVE-2026-116163: Js Auth Adapter Hook Copy Of Inherited Base Defaultcve-2026-116163-js-auth-adapter-hook-copy-of-inherited-base-default
Auth adapter/provider hook methods are installed with a direct bracket-read copy ($ADAPTER[$KEY] = $OPT[$KEY]) that resolves the prototype chain and is neither filtered to own properties nor checked against the base adapter class defaults. If the configured adapter is a class instance extending the base adapter class and only implements the granular hooks (v
