Aries from the VRChat.community project has discovered that the newly added auth/user/interestsAndPreferences endpoint appears to be affected by a typical prototype pollution bug:

Keys like "hasOwnProperty", "propertyIsEnumerable", "toLocaleString", "toString", and "valueOf" which aren't part of the supported interestsAndPreferences allowlist are able to be set when they shouldn't be whereas others, such as "meow", are ignored.