Description

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-26T14:16:51.297Z",
  "pubdate": "2026-09-26T14:16:51.297Z",
  "executiveSummary": "stoatchat versions prior to 0.15.5 contain a critical input validation vulnerability stemming from improper Unicode normalization handling. This flaw allows malicious actors to bypass character allowlists, length restrictions, and reserved name policies.\nThe vulnerability occurs because the application performs Unicode sanitization before final validation, creating a window where transformed characters can circumvent security controls. Attackers can leverage this to register usernames containing forbidden characters, mimic reserved identifiers, or exceed the 32-character storage limit.\nThe impact includes potential impersonation of administrative accounts, bypass of security filters intended to prevent cross-site scripting or database injection via username fields, and potential buffer handling issues due to excessive string lengths.\nThe risk is categorized as significant because it undermines the integrity of the user identification system. Exploitation requires only the ability to interact with the registration or account management interfaces. No elevated privileges are initially required to perform these actions.",
  "technicalDetails": "The root cause of this vulnerability is a flawed sequence of security operations within the stoatchat user registration and profile management logic. Specifically, the application applies Unicode sanitization routines prior to conducting final character allowlist validation and length enforcement checks.\nThe application relies on Unicode normalization (such as NFKC or NFKD) to sanitize inputs. An attacker can supply Unicode sequences that appear benign during initial filtering but normalize into prohibited characters—such as control characters, symbols, or reserved delimiters—after the security check has already been performed. This logic error enables the injection of characters that the system explicitly intends to forbid.\nThe exploitation flow proceeds as follows: First, the attacker identifies the application's sanitization routine and selects Unicode characters that transform into restricted characters upon canonicalization. Second, the attacker submits these specially crafted Unicode strings during a username creation or modification request. Third, the sanitization engine processes the characters, normalizing them into their prohibited form. Because the security validation logic has already verified the 'sanitized' (or original) input and lacks a secondary re-validation step post-normalization, the backend accepts the malicious string as valid.\nThis flaw effectively bypasses length limits as well. If an attacker submits a character string that is under the 32-character limit but normalizes to a longer string, or manipulates the normalization process to bypass character-count checks, they can force the application to store strings exceeding the designated 32-character database buffer limit. This may lead to truncated data, unexpected database behavior, or secondary injection vulnerabilities in downstream components that process these usernames.\nAffected versions include all releases of stoatchat prior to 0.15.5. The vulnerability is exploitable over the network without requiring prior authentication. Successful exploitation leads to identity spoofing, bypass of administrative naming restrictions, and potential manipulation of application logic that relies on the integrity of the username field."
}