CVE-2026-100674

MEDIUMCVSS 4.3

Description

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 30th, 2026 3:22 PM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-180

References & Reports

Advisories, patches, and third-party reports

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5
https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization

Source: NIST NVD · Data may lag official sources by up to one minute