This vulnerability involves missing authorization checks in the 'Login with phone number' component by Hamid Alinia, affecting versions up to 1.7.18. The flaw allows unauthorized users to perform actions that should require proper authorization, potentially leading to limited integrity issues. The CVSS score is 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and unchanged scope. No patch or vendor advisory is currently available to confirm remediation status.

The impact is limited to integrity, meaning unauthorized actions could be performed without proper authorization. There is no impact on confidentiality or availability. No known exploits are reported, reducing immediate risk. However, the missing authorization could be leveraged in specific scenarios to alter data or behavior improperly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review and strengthen authorization controls around the login-with-phone-number functionality where possible. Monitor for vendor updates or patches addressing this vulnerability.