CVE-2026-110374 in Login with phone number Plugin
Summary
by MITRE • 10/15/2026
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The identified security flaw represents a critical failure in access control mechanisms within the Hamid Alinia application, specifically affecting versions ranging from an unspecified initial release up to version 1.8.77. This vulnerability is classified as a Missing Authorization issue, which fundamentally indicates that the software fails to properly verify whether an authenticated user has the necessary permissions to perform specific actions or access certain resources. In this particular context, the flaw resides within the phone number-based login functionality, known internally or functionally as login-with-phone-number. The core technical deficiency lies in the server-side logic handling authentication requests and subsequent session management, where the system does not adequately enforce security levels associated with different user roles or configurations. This oversight allows an attacker to bypass intended restrictions by manipulating request parameters or exploiting inconsistencies in how access rights are validated after a successful phone number verification.
From a technical perspective, this vulnerability aligns closely with CWE-284, which describes Improper Access Control, and more specifically CWE-639 regarding Authorization Bypass Through User-Controlled Key. The operational mechanism likely involves the application accepting authentication tokens or session identifiers generated during the phone login process without sufficiently checking if those credentials are authorized for the specific administrative or privileged actions being attempted. An attacker could potentially exploit this by crafting malicious API requests that mimic legitimate traffic but target endpoints requiring higher security clearance, thereby gaining unauthorized access to sensitive user data, configuration settings, or backend systems. The absence of robust server-side validation means that client-side checks or default configurations are insufficient to prevent privilege escalation or unauthorized resource consumption.
The impact of such a vulnerability is severe and multifaceted. It directly compromises the confidentiality, integrity, and availability of application resources depending on what can be accessed through this bypass. Attackers could extract personally identifiable information from user profiles, modify account settings without permission, or even escalate privileges to gain administrative control over the platform. This not only violates data protection regulations such as GDPR or CCPA due to unauthorized access but also erodes trust in the application's security posture. Furthermore, if the phone number login system is integrated with broader identity management frameworks, this weakness could serve as a pivot point for more extensive attacks against connected services, amplifying the risk beyond the immediate scope of the mobile or web interface.
To mitigate this vulnerability, developers must implement strict server-side authorization checks on all endpoints accessible via the phone number authentication flow. This involves ensuring that every request is validated against an access control matrix that explicitly defines which roles can perform specific actions. Implementing principle of least privilege ensures that users are granted only the minimum permissions necessary for their function. Additionally, adopting standardized frameworks like OWASP Access Control Cheat Sheet guidelines will help in structuring these checks effectively. Regular security audits and penetration testing focused on broken object level authorization should be conducted to identify similar gaps across other modules. Updating to a patched version of the software where this logic has been corrected is the primary remediation step for end-users, while developers must review their authentication middleware to ensure that session validation includes comprehensive permission verification before processing any sensitive operations.