The issue is related to the handling of USSD codes in tel: links. When a user clicks on such a link, USSD codes specified after a `*` character are included in the phone number. This could potentially lead to actions being performed on a user's account, similar to a cross-site request forgery attack, on certain phones or with certain carriers.