Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100679stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in stoatchat from stoatchat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

Affected products (as reported)

Vendor	Product	Versions
stoatchat	stoatchat	0 – before 0.15.5

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-gwg6-q3c3-97cx) vendor-advisory
VulnCheck Advisory: stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket third-party-advisory