CVE-2026-100679GHSA-gwg6-q3c3-97cx
stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
stoatchat stoatchat
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.15.5stoatchatCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.
Text from CVE List
Affected versions 2
- stoatchataffected: all versions before 0.15.5CVE List
- stoatchatunaffected: 0.15.5CVE List