# CVE-2026-100678: stoatchat MFA brute force via insufficient rate limiting

Source: https://junglewise.ai/threats/cve-2026-100678-stoatchat-before-0-15-5-fails-to-enforce-account-level-attempt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100678 · Severity: medium · CVSS 6.5 · Published 2026-09-26

stoatchat is a chat application that uses multi-factor authentication (MFA) to protect user accounts. The application fails to properly limit repeated login attempts at the account level, allowing attackers who know a password to guess TOTP codes by distributing guesses across multiple IP addresses and reusing MFA challenge tokens. A successful attack bypasses MFA protection and grants full account access.

Technologies: [Stoatchat](https://junglewise.ai/threats/technologies/stoatchat). Vendors: [Stoatchat](https://junglewise.ai/threats/vendors/stoatchat).

## Quick answers

**Is CVE-2026-100678 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100678 being exploited in the wild.

**How severe is CVE-2026-100678?** Medium severity, with a CVSS score of 6.5, published 26 September 2026.

**Which products and versions are affected?** Stoatchat before 0.15.5.

**Is there a fix for CVE-2026-100678?** A patch was published on 2026-09-11: version 0.15.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100678 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-100678?** Check whether you run Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MFA login flow does not enforce account-level attempt limits, relying only on IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed TOTP guesses and distribute attempts across different source IPs to circumvent per-IP rate limiting. The vulnerability affects versions before 0.15.5 and requires knowledge of the target account's password as a precondition.

## Affected products

- stoatchat stoatchat before 0.15.5

## Timeline

- 2026-09-26: disclosed
- 2026-09-11: patched: version 0.15.5 released

## References

- [https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8](https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8)
- [https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting](https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting)

## Related threats

- [stoatchat account enumeration in login endpoint](https://junglewise.ai/threats/cve-2026-100677-stoatchat-before-0-15-5-contains-an-account-enumeration)
- [stoatchat January media proxy SSRF via SVG image href](https://junglewise.ai/threats/cve-2026-100676-january-the-media-proxy-embed-service-of-stoatchat-stoatchat)
- [stoatchat username validation bypass via Unicode sanitization](https://junglewise.ai/threats/cve-2026-100674-stoatchat-before-0-15-5-fails-to-revalidate-usernames-after)
- [stoatchat SSRF via DNS blocklist bypass in January proxy](https://junglewise.ai/threats/cve-2026-63088-stoatchat-ssrf-via-dns-blocklist-bypass-in-january-proxy)
- [stoatchat delta authorization bypass in webhook fetch endpoint](https://junglewise.ai/threats/cve-2025-71388-stoatchat-delta-authorization-bypass-in-webhook-fetch-endpoint)