{"id":"CVE-2026-100679","title":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token","summary":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-639"],"vendor":"stoatchat","product":"stoatchat","affected":["stoatchat < 0.15.5"],"published":"2026-09-26","updated":"2026-09-26","sourceUpdated":"2026-09-26T14:16:51.993","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100679","references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-26T13:33:20.909Z","slug":"CVE-2026-100679","body":"## Overview\n\nstoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}