This vulnerability (CVE-2026-18642) in eta-otp-lock is due to unsafe deserialization of untrusted data, categorized under CWE-502. It allows an attacker to perform object injection, which can compromise the application by manipulating serialized objects during deserialization. The issue affects all versions prior to 1.0.4 of eta-otp-lock. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attack requires local access with low complexity, no privileges, and user interaction, but can result in high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system due to object injection via deserialization of untrusted data. This can allow attackers to execute arbitrary code or manipulate application logic. The vulnerability requires local access and user interaction but does not require privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid deserializing untrusted data and restrict local access to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.