Executive brief
stoatchat is a messaging and communication platform. An attacker can bypass multi-factor authentication (MFA) by using their own valid MFA ticket with a victim's session token, allowing them to disable two-factor authentication, view recovery codes, or delete accounts. This requires only that the attacker has obtained a victim's session token, making account takeover possible without knowing the victim's password.
Technical details
The vulnerability exists in stoatchat's MFA ticket validation: while the MFATicket struct contains an account_id field, the API endpoints that consume MFA tickets (such as DELETE /auth/mfa/totp and POST /auth/mfa/recovery) never verify that the ticket's account_id matches the user ID resolved from the session token. An attacker with a valid session token from a compromised or leaked source can present their own MFA ticket, which is accepted for any sensitive operation, bypassing the second factor entirely. The flaw affects sensitive operations that require X-MFA-Ticket validation but do not separately re-verify the current password.
Affected products
- stoatchat before 0.15.5
Timeline
- 2026-09-11: disclosed
- 2026-09-26: advisory