A vulnerability in stoatchat versions before 0.15.5 allows attackers to bypass multi-factor authentication (MFA) by using their own valid MFA ticket combined with another user's session token. This flaw enables unauthorized actions such as disabling TOTP, viewing recovery codes, or performing other sensitive operations without the victim's credentials.