CVE-2026-100678: stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must know the target account's password and must then guess its TOTP MFA code. No additional privileges or user interaction are required.
Can IP-based rate limiting prevent exploitation?
Not reliably. The affected MFA flow applies rate limiting only by IP address, so an attacker can distribute guesses across multiple IP addresses and reuse the same MFA challenge ticket after failed attempts.
Which deployments should be prioritized for remediation?
Prioritize stoatchat deployments before version 0.15.5 that use TOTP MFA, particularly where attackers could obtain or guess user passwords. Accounts with high-value access are at increased risk because successful code guessing can result in account access.
How can exposure be reduced before upgrading?
The provided information identifies IP-based rate limiting as bypassable and does not specify an effective workaround. Upgrade stoatchat to version 0.15.5 or later to address the missing account-level attempt limits.