CVE-2026-100679
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user…
- Risk score
- 58/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery c…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.15.5 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.
Last activity 26 Sep 2026. Patch Forecast updates every hour.