This vulnerability (CVE-2026-65570) is classified under CWE-290, indicating an authentication bypass by spoofing in the 'Login with phone number' product by Hamid Alinia. It affects all versions up to and including 1.8.70. The vulnerability allows attackers to bypass authentication mechanisms without privileges or user interaction, potentially compromising confidentiality, integrity, and availability of the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts all three security properties (C, I, A) with high severity. No patch or official remediation level has been published yet.

Successful exploitation of this vulnerability allows unauthenticated attackers to bypass authentication controls, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could enable unauthorized access to sensitive data and system functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No vendor-provided temporary mitigations or workarounds are currently documented.