CVE-2026-100679 stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
Attackers can bypass MFA by using their own ticket with a victim's session token to disable TOTP or view recovery codes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100679?
CVE-2026-100679 is a high-severity authentication bypass vulnerability in stoatchat, published on 26 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.
Weakness: CWE-639
Which versions are affected by CVE-2026-100679?
How do I fix CVE-2026-100679?
No fix has been published for CVE-2026-100679 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-100679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100679 exists.
Sources
Also known as GHSA-2jwx-p7f6-684c, GHSA-gwg6-q3c3-97cx.