CVE-2026-100674

stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

State: Published
Severity: 5.3 Medium
Published: Sep 26, 2026
Updated: Sep 30, 2026
Reserved: Sep 26, 2026

Description

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-180 Incorrect Behavior Order: Validate Before Canonicalize

Affected Products

Product	Versions
stoatchatstoatchat	before 0.15.5Affected 0.15.5Not affected

References

GitHub Security Advisory (GHSA-qcwh-c934-wrv5)vendor-advisory
VulnCheck Advisory: stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitizationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.