CVE-2026-65570 in Login with phone number Plugin
Summary
by MITRE • 08/06/2026
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability represents a critical authentication bypass flaw affecting systems that implement phone number based login functionality in versions up to and including 1.8.70. The issue stems from inadequate input validation and authentication flow control mechanisms that allow unauthorized users to circumvent the standard verification process. The vulnerability typically manifests when the system fails to properly validate the phone number format or when it does not adequately enforce session management controls during the authentication sequence. Attackers can exploit this weakness by crafting malicious requests that bypass the normal phone number verification steps, potentially gaining access to user accounts without proper credentials.
The technical implementation flaw occurs within the authentication middleware where phone number validation routines are either absent or insufficiently enforced. This creates an opportunity for attackers to manipulate request parameters and skip crucial verification steps that should occur before granting access privileges. The vulnerability aligns with CWE-287 which addresses improper authentication issues, specifically focusing on weak authentication mechanisms and bypass scenarios. Additionally, this weakness can be categorized under ATT&CK technique T1110 which covers credential access through various methods including authentication bypass techniques.
The operational impact of this vulnerability extends beyond simple unauthorized access as it can enable attackers to perform account takeovers, data breaches, and potentially escalate privileges within the affected system. When phone number based authentication is used for sensitive operations such as password resets or account recovery, this vulnerability becomes particularly dangerous as it allows malicious actors to hijack legitimate user sessions. The risk is amplified in environments where phone number verification serves as a primary security control, making the bypass effectively equivalent to removing a critical security barrier.
Mitigation strategies should focus on implementing robust input validation for phone number formats including proper regex pattern matching and length constraints. System administrators must ensure that all authentication flows properly validate user inputs before proceeding with session establishment. The implementation of rate limiting and account lockout mechanisms can help prevent automated exploitation attempts. Additionally, organizations should consider implementing multi-factor authentication as an additional security layer, as this vulnerability primarily affects single-factor authentication systems. Regular security updates and patches should be applied immediately upon release to address known vulnerabilities in the affected versions.