CVE-2026-3655: Unauthenticated Auth Bypass in OTP Login Plugin (CVSS 9.8)

CVE-2026-3655 (CVSS 9.8): Critical authentication bypass in OTP Login With Phone Number plugin <= 1.8.60. Attackers log in as any user, including admins, without credentials.