NoSQL operator injection for auth bypass
When JSON bodies flow into a Mongo query unfiltered, operator objects turn a login into an always-true match.
When JSON bodies flow into a Mongo query unfiltered, operator objects turn a login into an always-true match.