What’s Vulnerable › Vulnerabilities

CVE-2026-100679: stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-26 · updated 2026-09-28
• Weakness: CWE-639

Description

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

Affected products

• stoatchat: before 0.15.5 — fixed in 0.15.5

How to fix

Upgrade to a fixed version: stoatchat 0.15.5. Check the vendor advisory for mitigations.

References

• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx
• https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket
• https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx

Get alerted when CVE-2026-100679 or the next vulnerability affects your stack