{"id":"CVE-2026-100679","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-100679","generatedAt":"2026-10-28T01:51:21.016Z","title":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token.","description":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.","published":"2026-09-26T14:16:52.000Z","lastModified":"2026-09-28T18:17:15.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":7.1,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00407,"percentile":0.34702,"date":"2026-10-26","history":[{"date":"2026-09-27","score":0.00322,"percentile":0.22695}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-26T14:16:52.000Z","detail":{"score":"7.1","severity":"HIGH","publishedAt":"2026-09-26T14:16:51.993Z"},"summary":"New CVE, high severity (CVSS 7.1)."}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket","source":"disclosure@vulncheck.com"},{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100679","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}