This vulnerability (CVE-2026-65460) affects Zarinpal Gateway versions up to and including 5.1.0 and is classified as CWE-352 (Cross-Site Request Forgery). It allows an attacker to trick an unauthenticated user into submitting a forged request, potentially causing unintended actions. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily on integrity, with no confidentiality or availability impact. The vulnerability requires no privileges and user interaction is required to trigger the issue. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The impact is limited to integrity, where an attacker can cause unauthorized state-changing requests to be executed without the user's consent. There is no impact on confidentiality or availability. The vulnerability requires user interaction but no authentication, making it a moderate risk for affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens or other request validation mechanisms if possible. Monitor vendor channels for updates and apply patches promptly once available.