CVE-2026-100676

The media proxy/embed service of stoatchat (stoatchat/stoatchat) before version 0.15.5 contains a vulnerability where it improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml . An unauthenticated remote attacker can exploit this via the /prox...

CVE-2026-100676 stoatchat before 0.15.5 Local Filesystem Read via SVG

January, the media proxy/embed service of stoatchat stoatchat/stoatchat, before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG e.g...

CVE-2026-100677

Versions of stoatchat before 0.15.5 are vulnerable to an account enumeration vulnerability within the login endpoint. Unauthenticated attackers can distinguish between registered and unregistered email addresses by analyzing the error location fields returned during POST /api/auth/session/login r...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

EUVD-2026-87650

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100677 stoatchat before 0.15.5 Account Enumeration via Error Location

stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST...

CVE-2026-100675 stoatchat before 0.15.5 Denial of Service via mass mentions

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges...

CVE-2026-100675

Versions of stoatchat prior to 0.15.5 are susceptible to a denial of service vulnerability within the acknowledgement worker during the processing of mass mention messages. An authenticated user can trigger this by sending five specially crafted role-mention messages , which results in the termin...

CVE-2026-100675 stoatchat before 0.15.5 Denial of Service via mass mentions

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges...

CVE-2026-100675 stoatchat before 0.15.5 Denial of Service via mass mentions

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges...

EUVD-2026-87769

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges...

EUVD-2026-87768

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

CVE-2026-100674 stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

CVE-2026-100674 stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

CVE-2026-100674 stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

CVE-2026-100674

The stoatchat application (versions prior to 0.15.5 ) is vulnerable to a username validation bypass due to insufficient revalidation after Unicode sanitization . An attacker can submit Unicode letters that transform into forbidden characters post-sanitization, allowing them to bypass character al...

CVE-2026-100674: Incorrect Behavior Order: Validate Before Canonicalize

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create...

PT-2026-99345

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description Insufficient revalidation of usernames after Unicode sanitization allows the creation of usernames containing forbidden characters. By submitting specific Unicode letters that transform into...

CVE-2026-100679: Authorization Bypass Through User-Controlled Key

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable...

CVE-2026-100678: Improper Restriction of Excessive Authentication Attempts

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP...