Circumvent this credentials validator This is a program I wrote in JavaScript to validate some inputted credentials, with an intentional vulnerability. The credentials_validator function takes an object as input, with usernames and passwords. It returns a function, which takes a username and password and returns true if the credentials are valid.
Your challenge is to find a username and password which, when passed to the function returned by credentials_validator, cause it to return true without knowledge of the credentials ahead of time.
This is a programming-puzzle, so the first valid answer wins.
Program:
var credentials_validator = (credentials) =&gt; {
    if (typeof credentials !== &quot;object&quot;)
        throw new TypeError(&quot;'credentials' must be an object&quot;);
    
    for (var username in credentials)
        if (typeof credentials[username] === &quot;object&quot;)
            throw new TypeError(&quot;Passwords may not be objects or 'null'&quot;);
    
    return (username, password) =&gt; {
        if (typeof password === &quot;object&quot;)
            throw new TypeError(&quot;Passwords may not be objects or 'null'&quot;);
        
        if (!(username in credentials))
            return false;
        
        if (credentials[username] === password)
            return true;
        
        return false;
    };
};

/*

Run with:

    var validator = credentials_validator({
        &quot;J. Doe&quot;: &quot;P4ssword&quot;,
        &quot;R. Wolf&quot;: &quot;1234&quot;,
        &quot;X. Ample&quot;: &quot;wxyz#1&quot;
    });

    validator(&quot;J. Doe&quot;, &quot;P4ssword&quot;); // true
    validator(&quot;R. Wolf&quot;, &quot;123&quot;); // false

*/
username = 'toString', password = {}.toString

Try it online!
Note: Due to a certain username pointed out by Wezl in the comments, this answer is not valid for the current challenge.
Why this works:

 Among other properties, Object.prototype.toString is inherited from Object.prototype, even if it wasn't a part of the object literal given to the validator. Since any object inherits the same function {}.toString is the same as the toString of the credentials object.