Privilege Escalation via Incorrect Phone Number Login Assignment

Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The "Login with phone number" plugin (versions up to 1.8.77) contains an Incorrect Privilege Assignment vulnerability (CWE-266) that allows attackers to escalate their privileges within affected systems. This vulnerability is particularly dangerous because phone number-based authentication has become increasingly common as a user-friendly alternative to traditional username/password schemes. Any organization using this plugin—especially SaaS platforms, mobile applications, and multi-tenant systems relying on phone verification—faces immediate risk of unauthorized privilege elevation. An attacker with basic access can manipulate the login mechanism to assume administrative or elevated roles, potentially gaining unauthorized access to sensitive data, system configurations, and other user accounts.

Casky.ai's 224 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns associated with TA0004 (Privilege Escalation) techniques behind this vulnerability. Practitioners using Casky would observe detection findings focused on suspicious account permission changes following phone-based authentication events, unusual role assignments without corresponding admin actions, and authentication logs showing mismatched privilege levels for specific phone numbers. The platform's skills would correlate MITRE ATT&CK indicators such as abuse of elevation control mechanisms and permission assignment anomalies, flagging patterns like rapid privilege escalation attempts, phone numbers triggering admin-level access, and post-authentication permission modifications. This multi-layered detection approach helps security teams identify exploitation attempts in real-time, even in complex environments where privilege escalation might otherwise blend into normal administrative activity.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110373.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-110373

Casky has 224 skills that investigate the attack patterns behind CVE-2026-110373. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn