CVE-2026-100678CWE-307

CVE-2026-100678

Medium · published September 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-09-26T18:16Z
References (3)
https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8 · [email protected]https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting · [email protected]https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 26 SEP 13:23Z
    stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
    cvelistv5