CVE-2026-100679

Versions of stoatchat prior to 0.15.5 are vulnerable to an MFA bypass due to a failure in validating that MFA tickets belong to the authenticated user. An attacker can obtain a valid ticket from their own account and utilize it in conjunction with a victim's session token. This allows the attacke...