Context: Broken Access Control (BAC) is ranked by OWASP as the most critical web security risk. Open-source JavaScript projects, with their openness and diverse contributors, are particularly exposed. Objective: This study investigates the prevalence and patterns of BAC vulnerabilities in open-source JavaScript projects, addressing the lack of empirical evidence beyond enterprise systems. Method: A hybrid approach combined Semgrep static analysis with manual penetration testing. A curated set of 166 GitHub repositories was scanned using custom rules for Insecure Direct Object Reference (IDOR), unprotected routes, forced browsing, and token/session flaws; flagged cases were validated in Docker with Postman. Results: Of 166 repositories, 33 were flagged and 5 confirmed exploitable. Vulnerabilities included unauthenticated endpoints, parameter-based privilege escalation, and insecure token or Cross-Origin Resource Sharing (CORS) handling. Static analysis was useful but showed high false positives and limited contextual accuracy. Conclusion: BAC vulnerabilities recur in open-source JavaScript projects. Static tools aid detection but require manual validation for reliable assessment.