CVE-2026-100678 in stoatchat
Riassunto
di MITRE • 26/09/2026
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.