CVE-2026-100679

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5

Description An issue exists where the system fails to validate that Multi-Factor Authentication (MFA) tickets belong to the authenticated user. This allows an attacker to bypass MFA by using a valid ticket from their own account in conjunction with another user's session token. Consequently, an attacker can disable Time-based One-Time Password (TOTP) settings, view recovery codes, or perform other sensitive operations without the victim's credentials.

Recommendations Update stoatchat to version 0.15.5 or later.