This vulnerability in Heateor Social Login (versions up to 1.1.39) allows Cross-Site Request Forgery (CSRF) attacks, where an attacker can induce an authenticated user to perform actions without their consent. The CVSS 3.1 base score is 5.4, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could lead to unauthorized actions performed by authenticated users, potentially affecting the integrity and availability of the affected system. There is no confidentiality impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting actions to trusted origins if possible.