CVE-2026-100674

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5

Description Insufficient revalidation of usernames after Unicode sanitization allows the creation of usernames containing forbidden characters. By submitting specific Unicode letters that transform into rejected characters during the sanitization process, attackers can bypass character allowlists and length limits. This enables the creation of reserved-name lookalikes, the embedding of special characters, and the ability to exceed the 32-character storage limit.

Recommendations Update stoatchat to version 0.15.5 or later.