Vulnerability Description
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx
- https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cros
- https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx
FAQ
What is CVE-2026-100679?
CVE-2026-100679 is a vulnerability with a CVSS score of 8.8 (HIGH). stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attacke...
How severe is CVE-2026-100679?
CVE-2026-100679 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100679?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.