CVE-2026-100679
stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 26, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 26, 2026
Description
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
stoatchatstoatchat |
|
References
- GitHub Security Advisory (GHSA-gwg6-q3c3-97cx)vendor-advisory
- VulnCheck Advisory: stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticketthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.