Vulnerability Description
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8
- https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8
FAQ
What is CVE-2026-100678?
CVE-2026-100678 is a vulnerability with a CVSS score of 6.5 (MEDIUM). stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers ca...
How severe is CVE-2026-100678?
CVE-2026-100678 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100678?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.