Validate credentials are string

server/auth/LocalAuthStrategy.js

@@ -49,6 +49,12 @@ class LocalAuthStrategy {
    * @param {Function} done - Passport callback
    */
   async verifyCredentials(req, username, password, done) {
+    if (typeof username !== 'string' || typeof password !== 'string') {
+      this.logFailedLoginAttempt(req, typeof username === 'string' ? username : '[non-string]', 'Invalid username or password')
+      done(null, null)
+      return
+    }
+
     // Load the user given it's username
     const user = await Database.userModel.getUserByUsername(username.toLowerCase())