CVE-2026-100679

HIGHCVSS 8.8

Description

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

Timeline

Published:September 26th, 2026 2:16 PM

Last modified:September 28th, 2026 6:17 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-639

References & Reports

Advisories, patches, and third-party reports

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx
https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket
https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx

Source: NIST NVD · Data may lag official sources by up to one minute