Absence of Token expiry leads to Unauthorized login Access

Summary While doing the testing for the mobile app, I observed out that it is possible to bypass the authentication and gain unauthorized access to the user's account bu brute-forcing the PIN due to lack of login token expiry.

POST /api/v3/login/phone/ HTTP/1.1
Content-Type: application/json; charset=UTF-8
Content-Length: 40
Host: hackerone.affirm-odin.com
Connection: close
Accept-Encoding: gzip, deflate
User-Agent: okhttp/3.13.1
Affirm-User-Agent: Affirm-Android

{"channel":"sms","address":"7022170000"}