Executive brief
stoatchat, a communication platform, contains a flaw that allows users to bypass account registration controls. This means security measures like invite-only modes, email verification, and captchas are ignored, allowing anyone to create an unlimited number of accounts. This could lead to service disruptions from spam or automated attacks and undermines the integrity of the user base.
Technical details
A vulnerability in the backend/delta component of stoatchat (Revolt) results from the improper use of a validation framework (CWE-1173). Specifically, the application was using default configuration settings instead of the intended security configuration, causing it to skip enforcement of invite-only modes, email verification, captchas, and shield verification during account creation. An unauthenticated remote attacker can exploit this by sending registration requests that bypass these intended hurdles. This allows for the mass creation of verified accounts with invalid emails, facilitating denial-of-service (DoS) attacks and spam. The issue is fixed in version 0.7.8 by correctly specifying the authifier configuration.
Affected products
- stoatchat stoatchat > 0.6.13, < 0.7.8
Timeline
- 2024-06-21: advisory: GitHub Security Advisory published
- 2024-06-12: patched: Version 0.7.8 released
- 2026-07-16: disclosed: CVE published to NVD