CVE-2026-100678información

Resumen

por MITRE • 2026-09-26

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Divulgación

2026-09-26

Moderación

en revisión

EPSS

0.00000

KEV

no

Actividades

muy bajo

Fuentes

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-100678
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-100678
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-100678/

◂ AnteriorVisión De ConjuntoPróximo ▸

Interested in the pricing of exploits?

See the underground prices here!