CVE-2026-100679

Deferred Deferred - Pending Action

Authentication Bypass via MFA Ticket in StoaChat

Publication date: 2026-09-26

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-28

Generated

2026-10-17

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100679

EUVD

EUVD-2026-87652

Affected Vendors & Products

Vendor	Product	Version / Range
stoatchat	stoatchat	to 0.15.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in stoatchat before version 0.15.5 allows attackers to bypass multi-factor authentication (MFA) by using their own valid MFA ticket with another user's session token. The system fails to validate that the MFA ticket belongs to the authenticated user, enabling unauthorized actions like disabling TOTP or viewing recovery codes without the victim's credentials.

Detection Guidance

To detect this vulnerability, check if your stoatchat instance is running a version before 0.15.5. Use commands like 'curl -s https://your-stoatchat-domain.com/version' or inspect package metadata. If vulnerable, update to version 0.15.5 or later immediately.

Impact Analysis

If exploited, this vulnerability could allow attackers to bypass MFA protections, gain unauthorized access to your account, disable security features like TOTP, or retrieve recovery codes. This could lead to account takeover or unauthorized sensitive operations if an attacker obtains your session token.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate compliance requirements under GDPR and HIPAA. GDPR mandates strict protection of personal data, and HIPAA requires safeguards for protected health information. A successful MFA bypass could result in unauthorized disclosure or modification of such data, potentially leading to regulatory penalties.

Mitigation Strategies

Immediately upgrade stoatchat to version 0.15.5 or later to patch the vulnerability. Review logs for suspicious cross-account MFA ticket usage or unauthorized account modifications. Disable MFA ticket reuse if possible and monitor for unauthorized TOTP or recovery code changes.

Hi! I’m here to help you understand CVE-2026-100679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70