# CVE-2026-100674: stoatchat username validation bypass via Unicode sanitization

Source: https://junglewise.ai/threats/cve-2026-100674-stoatchat-before-0-15-5-fails-to-revalidate-usernames-after  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100674 · Severity: medium · CVSS 4.3 · Published 2026-09-26

stoatchat is a chat application that validates usernames when accounts are created. The application fails to properly re-validate usernames after performing Unicode character transformations, allowing attackers to create accounts with forbidden characters, impersonation-like names, and names exceeding normal length limits. This could enable account impersonation, confusion, and downstream system problems.

Technologies: [Stoatchat](https://junglewise.ai/threats/technologies/stoatchat). Vendors: [Stoatchat](https://junglewise.ai/threats/vendors/stoatchat).

## Quick answers

**Is CVE-2026-100674 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100674 being exploited in the wild.

**How severe is CVE-2026-100674?** Medium severity, with a CVSS score of 4.3, published 26 September 2026.

**Which products and versions are affected?** Stoatchat before 0.15.5.

**Is there a fix for CVE-2026-100674?** A patch was published on 2026-09-26: Version 0.15.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100674 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100674?** Check whether you run Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a validate-before-canonicalize flaw (CWE-180): usernames are validated against a regex and blocklist before Unicode sanitization, but the character allowlist and length limit are not re-applied after sanitization. Unicode characters accepted by the initial regex can transform into punctuation, spaces, or extended sequences through the decancer library. An attacker with login capability can submit Unicode payloads to bypass character restrictions and create names up to 160 characters despite the 32-character storage limit.

## Affected products

- stoatchat stoatchat before 0.15.5

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Version 0.15.5

## References

- [https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5)
- [https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization](https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization)

## Related threats

- [stoatchat MFA brute force via insufficient rate limiting](https://junglewise.ai/threats/cve-2026-100678-stoatchat-before-0-15-5-fails-to-enforce-account-level-attempt)
- [stoatchat account enumeration in login endpoint](https://junglewise.ai/threats/cve-2026-100677-stoatchat-before-0-15-5-contains-an-account-enumeration)
- [stoatchat January media proxy SSRF via SVG image href](https://junglewise.ai/threats/cve-2026-100676-january-the-media-proxy-embed-service-of-stoatchat-stoatchat)
- [stoatchat SSRF via DNS blocklist bypass in January proxy](https://junglewise.ai/threats/cve-2026-63088-stoatchat-ssrf-via-dns-blocklist-bypass-in-january-proxy)
- [stoatchat delta authorization bypass in webhook fetch endpoint](https://junglewise.ai/threats/cve-2025-71388-stoatchat-delta-authorization-bypass-in-webhook-fetch-endpoint)