Executive brief
stoatchat is a chat application that uses multi-factor authentication (MFA) to protect user accounts. The application fails to properly limit repeated login attempts at the account level, allowing attackers who know a password to guess TOTP codes by distributing guesses across multiple IP addresses and reusing MFA challenge tokens. A successful attack bypasses MFA protection and grants full account access.
Technical details
The MFA login flow does not enforce account-level attempt limits, relying only on IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed TOTP guesses and distribute attempts across different source IPs to circumvent per-IP rate limiting. The vulnerability affects versions before 0.15.5 and requires knowledge of the target account's password as a precondition.
Affected products
- stoatchat stoatchat before 0.15.5
Timeline
- 2026-09-26: disclosed
- 2026-09-11: patched: version 0.15.5 released