Authentication bypass via yescrypt plaintext comparison

Authentication bypass in BusyBox httpd in Red Hat Hardened Images allows remote attackers to access protected resources with a yescrypt hash. The Basic Authentication check recognizes only dollar-prefixed hashes whose next character is a digit, so a $y$ yescrypt value enters the plaintext branch and is compared directly with the supplied password. This condition requires httpd to protect content with a yescrypt entry and the attacker to obtain that stored hash; access is limited to resources covered by the entry.