CVE-2026-21854: Js Auth Bracket Lookup Loose Equality
Authentication compares a bracket-indexed object lookup (e.g. users[username]) to a value using loose equality (==). When the bracket key originates from untrusted input, an attacker can pass "__proto__" so the lookup returns Object.prototype, which is truthy and is coerced by == to "[object Object]" — matching a chosen password and bypassing authentication.
JSgreprules fetch cve-2026-21854-js-auth-bracket-lookup-loose-equality --engine opengrepDescription
Authentication compares a bracket-indexed object lookup (e.g. users[username]) to a value using loose equality (==). When the bracket key originates from untrusted input, an attacker can pass "__proto__" so the lookup returns Object.prototype, which is truthy and is coerced by == to "[object Object]" — matching a chosen password and bypassing authentication.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.