Is CVE-2026-100679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100679 being exploited in the wild.

How severe is CVE-2026-100679?

High severity, with a CVSS score of 8.8, published 26 September 2026.

Is there a fix for CVE-2026-100679?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100679 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100679?

Check whether you run Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100679: stoatchat MFA bypass via cross-account ticket validation

CVE-2026-100679 · Severity: high · CVSS 8.8 · Published 2026-09-26

stoatchat is a messaging and communication platform. An attacker can bypass multi-factor authentication (MFA) by using their own valid MFA ticket with a victim's session token, allowing them to disable two-factor authentication, view recovery codes, or delete accounts. This requires only that the attacker has obtained a victim's session token, making account takeover possible without knowing the victim's password.

Quick answers

Is CVE-2026-100679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100679 being exploited in the wild.
How severe is CVE-2026-100679?: High severity, with a CVSS score of 8.8, published 26 September 2026.
Which products and versions are affected?: Stoatchat before 0.15.5.
Is there a fix for CVE-2026-100679?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100679 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100679?: Check whether you run Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in stoatchat's MFA ticket validation: while the MFATicket struct contains an account_id field, the API endpoints that consume MFA tickets (such as DELETE /auth/mfa/totp and POST /auth/mfa/recovery) never verify that the ticket's account_id matches the user ID resolved from the session token. An attacker with a valid session token from a compromised or leaked source can present their own MFA ticket, which is accepted for any sensitive operation, bypassing the second factor entirely. The flaw affects sensitive operations that require X-MFA-Ticket validation but do not separately re-verify the current password.

Affected products

stoatchat before 0.15.5

Timeline

2026-09-11: disclosed
2026-09-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.