This vulnerability in nghialuu Zalo Official Live Chat (<= 1.0.0) allows Cross-Site Request Forgery (CSRF) attacks, where an attacker can trick authenticated users into submitting unauthorized requests to the application. The CVSS 3.1 vector indicates the attack can be performed remotely with low attack complexity and requires user interaction, with no privileges required. The impact includes limited integrity and availability loss, but no confidentiality impact is noted.

Successful exploitation could lead to unauthorized actions being performed on behalf of authenticated users, potentially causing limited integrity and availability impacts within the application. There is no indication of confidentiality compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as anti-CSRF tokens or same-site cookie attributes as a temporary mitigation.