stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own… (CVE-2026-100679)
A vulnerability in stoatchat versions before 0.15.5 allows attackers to bypass multi-factor authentication (MFA) by using their own valid MFA ticket combined with another user's session token. This flaw enables unauthorized actions such as disabling TOTP, viewing recovery codes, or performing other sensitive operations without the victim's credentials.
AI Analysis
Technical Summary
stoatchat before version 0.15.5 fails to verify that MFA tickets are bound to the authenticated user. Attackers can exploit this by obtaining a valid MFA ticket from their own account and pairing it with a victim's session token, effectively bypassing MFA protections. This vulnerability is tracked as CVE-2026-100679 and is associated with CWE-639 (Authorization Bypass Through User-Controlled Key).
Potential Impact
Successful exploitation allows attackers to bypass MFA controls, leading to high confidentiality, integrity, and availability impacts. Attackers can disable TOTP, access recovery codes, and perform sensitive operations on behalf of victims without needing their credentials.
Mitigation Recommendations
A fix is available in stoatchat version 0.15.5. Users and administrators should upgrade to version 0.15.5 or later to remediate this vulnerability.
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own… (CVE-2026-100679)
Description
A vulnerability in stoatchat versions before 0.15.5 allows attackers to bypass multi-factor authentication (MFA) by using their own valid MFA ticket combined with another user's session token. This flaw enables unauthorized actions such as disabling TOTP, viewing recovery codes, or performing other sensitive operations without the victim's credentials.
CVSS v3.1
Score 8.8high
Affected software
pkg:github/stoatchat/stoatchatRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
stoatchat before version 0.15.5 fails to verify that MFA tickets are bound to the authenticated user. Attackers can exploit this by obtaining a valid MFA ticket from their own account and pairing it with a victim's session token, effectively bypassing MFA protections. This vulnerability is tracked as CVE-2026-100679 and is associated with CWE-639 (Authorization Bypass Through User-Controlled Key).
Potential Impact
Successful exploitation allows attackers to bypass MFA controls, leading to high confidentiality, integrity, and availability impacts. Attackers can disable TOTP, access recovery codes, and perform sensitive operations on behalf of victims without needing their credentials.
Mitigation Recommendations
A fix is available in stoatchat version 0.15.5. Users and administrators should upgrade to version 0.15.5 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2jwx-p7f6-684c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100679"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6ab89bdef7a7c54106942047
Added to database: 09/27/2026, 04:30:22 UTC
Last enriched: 09/27/2026, 04:42:47 UTC
Last updated: 09/28/2026, 01:47:40 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.