---
id: CVE-2026-100679
title: >-
  stoatchat before 0.15.5 fails to validate that MFA tickets belong to the
  authenticated user, allowing attackers to bypass MFA by using their own valid
  ticket with another user's session token
summary: >-
  stoatchat before 0.15.5 fails to validate that MFA tickets belong to the
  authenticated user, allowing attackers to bypass MFA by using their own valid
  ticket with another user's session token. Attackers can obtain a ticket from
  their own…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-639
vendor: stoatchat
product: stoatchat
affected:
  - stoatchat < 0.15.5
published: '2026-09-26'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T18:17:15.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100679'
references:
  - url: >-
      https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-28T18:01:30.780087Z'
ingestedAt: '2026-09-26T13:33:20.909Z'
epss: 0.00407
epssPercentile: 0.34773
---

## Overview

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.