CVE-2026-100678
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 26, 2026
Vendor
unknown
Description
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.