CVE-2026-110374: Missing Authorization in Hamid Alinia Login with phone number

This vulnerability involves missing authorization checks in the 'Login with phone number' component of Hamid Alinia's product. The issue arises from improperly configured access control security levels, which could allow an attacker with limited privileges to perform unauthorized actions. The affected versions are all releases from 0 up to 1.8.77 inclusive. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The impact is limited to integrity loss without confidentiality or availability effects. An attacker with low privileges could exploit the missing authorization to perform unauthorized actions within the affected versions. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply any forthcoming patches promptly.