CVE-2026-100678

MEDIUMCVSS 6.5

Description

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 30th, 2026 4:17 PM

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-307

References & Reports

Advisories, patches, and third-party reports

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8
https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting
https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8

Source: NIST NVD · Data may lag official sources by up to one minute