Insufficient Rate Limiting in Stoatchat MFA Login
CVE-2026-100678

8.3HIGH

Key Information:

Vendor

Stoatchat

Status
Stoatchat
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100678?

Stoatchat versions prior to 0.15.5 exhibit a serious flaw in enforcing account-level limits for Multi-Factor Authentication (MFA) login attempts. This inadequacy allows unauthorized attackers, who possess valid passwords, to successfully guess time-based one-time passwords (TOTP) while only facing limitations based on IP address. Attackers can exploit this weakness by reusing MFA challenge tickets across various failed attempts and distributing their guessing activities over different IP addresses, effectively circumventing the existing rate limiting measures, thereby compromising account security.

Affected Version(s)

stoatchat 0 < 0.15.5

stoatchat 0.15.5

References

https://github.com/stoatchat/stoatchat/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/stoatchat-before-0.1...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

QuentinRa
.