---
id: CVE-2026-100674
title: >-
  stoatchat before 0.15.5 fails to revalidate usernames after Unicode
  sanitization, allowing attackers to create usernames with forbidden characters
  by submitting Unicode letters that transform into rejected characters
summary: >-
  stoatchat before 0.15.5 fails to revalidate usernames after Unicode
  sanitization, allowing attackers to create usernames with forbidden characters
  by submitting Unicode letters that transform into rejected characters.
  Attackers can bypas…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-180
vendor: stoatchat
product: stoatchat
affected:
  - stoatchat < 0.15.5
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T14:16:51.297'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100674'
references:
  - url: >-
      https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T13:33:20.911Z'
---

## Overview

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.