This vulnerability in miniOrange OTP Verification (up to version 5.4.9) is due to incorrect privilege assignment, which enables an attacker to escalate privileges improperly. The CVSS 3.1 score of 9.8 reflects that the vulnerability is remotely exploitable without authentication or user interaction and leads to full system compromise (confidentiality, integrity, and availability). The vendor has not yet provided an official fix or remediation guidance, and no patch links are available. The affected product is not a cloud service, so remediation depends on vendor patch release and user application of updates.

Successful exploitation allows an unauthenticated attacker to escalate privileges, potentially gaining full control over the affected system or application. This can lead to complete compromise of confidentiality, integrity, and availability of the system using the miniOrange OTP Verification plugin. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor advisory or official patch is currently available to address this vulnerability.