Stoatchat versions before 0.15.5 do not enforce account-level attempt limits on multi-factor authentication (MFA) login challenges. This allows attackers who have obtained a user's password to repeatedly guess Time-based One-Time Password (TOTP) codes. The vulnerability arises because only IP-based rate limiting is applied, which can be bypassed by reusing MFA challenge tickets across multiple failed attempts and distributing guesses across different IP addresses.