The vulnerability in stoatchat prior to version 0.15.5 involves failure to revalidate usernames after Unicode sanitization. This flaw permits attackers to submit Unicode characters that, when normalized, become forbidden characters, thus bypassing character allowlists and length restrictions. The issue enables creation of usernames that mimic reserved names, include special characters, and exceed the intended 32-character storage limit. The CVSS 3.1 score is 4.3 (medium severity), reflecting limited impact on confidentiality and availability but some integrity impact.

Attackers can create usernames that bypass validation controls, potentially leading to impersonation or confusion by mimicking reserved names or embedding special characters. The integrity of username validation is compromised, but there is no direct impact on confidentiality or availability reported.

A fix is available in stoatchat version 0.15.5. Users and administrators should upgrade to version 0.15.5 or later to address this vulnerability. No additional mitigation steps are indicated by the vendor advisory.