MFA Bypass via TOTP Guessing in StoaChat

Executive Summary

CVE-2026-100678 is a vulnerability in the stoatchat application before version 0.15.5 where the MFA login flow fails to enforce account-level attempt limits on TOTP code challenges. Attackers who know a user's password can repeatedly request MFA challenges and guess TOTP codes because the system only uses IP-based rate limiting. This allows cumulative brute-force attempts against a single account, potentially granting unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Monitor for repeated MFA challenge requests from the same account or IP addresses. Check logs for multiple failed TOTP attempts without account lockout triggers. Look for patterns of distributed guesses across different IPs targeting a single account.

Useful 0 Not Useful 0

Impact Analysis

If you use stoatchat versions before 0.15.5, an attacker who knows your password could bypass MFA protections by repeatedly guessing TOTP codes. This could lead to unauthorized account access, data breaches, or misuse of your account. The vulnerability enables brute-force attacks that may succeed in as little as 3.86 days under certain conditions.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade stoatchat to version 0.15.5 or later to apply the patch.
• Implement account-level attempt limits for MFA challenges to prevent brute-force attacks.
• Enforce single-use MFA login tickets to prevent challenge reuse after failed attempts.
• Configure proper lockout mechanisms to trigger after multiple failed TOTP attempts.

Useful 0 Not Useful 0