This vulnerability is a CSRF issue in the 'Login with phone number' product by Hamid Alinia, affecting versions up to 1.6.93. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially compromising user accounts or application state. The CVSS 3.1 base score of 8.8 reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official fix information is available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could lead to unauthorized actions performed on behalf of authenticated users, resulting in potential compromise of user data confidentiality, integrity, and availability of the affected application. The high CVSS score indicates severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as anti-CSRF tokens, verifying the origin of requests, or applying web application firewall rules to mitigate potential exploitation.