The server writes plain-text log lines like this. What can an attacker do with the username field?

This is log injection, also called log forging. A username like bob\n2026-01-01 INFO Login succeeded for user admin adds a second, fake line. That can mislead investigators or hide an attack. If the logs are shown in a web tool, HTML in the input can also cause XSS in that tool. Fix: use structured JSON logs (for example with pino), which escape line breaks inside values. Also limit the length of logged input.

"Nothing, because log files are never shown to users" is the tempting wrong answer. Admins, dashboards and alert rules all read logs, and they are the target.