CVE-2026-100674: stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization
stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
stoatchat versions earlier than 0.15.5 should be treated as affected. Version 0.15.5 is the indicated fixed boundary.
What access does an attacker need?
The attacker needs low-level privileges, such as the ability to submit or create a username, and can exploit the issue remotely over the network. No user interaction is required.
How can administrators identify potential exposure?
Check the deployed stoatchat version and review usernames created through registration or username-update flows for values that may have changed after Unicode sanitization. Usernames containing forbidden or special characters, reserved-name lookalikes, or values exceeding the 32-character storage limit may indicate exploitation.