The Eric Allen APK Downloader application version 1.0.0 and earlier is vulnerable to CSRF attacks that can result in stored XSS. This vulnerability allows an attacker to trick an authenticated user into submitting unauthorized requests, which may lead to persistent script injection within the application. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of the victim user. This can compromise confidentiality, integrity, and availability of the affected application. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content or links that could trigger CSRF attacks. Implementing additional CSRF protections and input validation on the server side may help mitigate risk.