Executive brief
stoatchat is a chat application that validates usernames when accounts are created. The application fails to properly re-validate usernames after performing Unicode character transformations, allowing attackers to create accounts with forbidden characters, impersonation-like names, and names exceeding normal length limits. This could enable account impersonation, confusion, and downstream system problems.
Technical details
The vulnerability is a validate-before-canonicalize flaw (CWE-180): usernames are validated against a regex and blocklist before Unicode sanitization, but the character allowlist and length limit are not re-applied after sanitization. Unicode characters accepted by the initial regex can transform into punctuation, spaces, or extended sequences through the decancer library. An attacker with login capability can submit Unicode payloads to bypass character restrictions and create names up to 160 characters despite the 32-character storage limit.
Affected products
- stoatchat stoatchat before 0.15.5
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Version 0.15.5