stoatchat versions before 0.15.5 do not properly revalidate usernames after Unicode sanitization. This allows attackers to create usernames containing forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits, enabling creation of reserved-name lookalikes, embedding special characters, and exceeding the 32-character storage limit.