Hi Ak1T4, it was not validating both of those parameters, neither mobile num nor username. Creating a csrf payload keeping their values as null was also working here.