Description

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-26T14:16:51.857Z",
  "pubdate": "2026-09-26T14:16:51.857Z",
  "executiveSummary": "The vulnerability in stoatchat versions prior to 0.15.5 constitutes a significant security flaw in the Multi-Factor Authentication (MFA) implementation, specifically regarding Time-based One-Time Password (TOTP) validation.\nThe application fails to implement account-level rate limiting for MFA challenges, relying instead on insufficient IP-based rate limiting. This architecture flaw allows for the circumvention of brute-force protections when an attacker possesses valid account credentials.\nBy reusing MFA challenge tickets across multiple attempts and distributing requests across various IP addresses, an adversary can effectively bypass security controls to conduct high-volume TOTP code guessing.\nThis vulnerability leads to unauthorized account access, compromising the confidentiality and integrity of user accounts. The risk is critical, as it bypasses the secondary authentication factor intended to protect accounts against credential theft.\nExploitation requires the attacker to have already compromised or discovered the user's primary password. Once the password is known, the attacker can leverage the lack of account-locked rate limits to perform an automated brute-force attack against the TOTP challenge, gaining full access to the target account.",
  "technicalDetails": "The root cause of this vulnerability is the absence of stateful, account-bound rate limiting mechanisms for MFA verification within the stoatchat authentication workflow. The application treats MFA verification requests as independent events rather than part of an integrated, state-dependent authentication flow.\nIn stoatchat versions before 0.15.5, the system fails to tie specific MFA challenge tickets to an account-specific counter for failed attempts. Because the MFA challenge ticket remains valid across multiple failed verification attempts, an attacker can persistently submit new TOTP guesses without the system invalidating the underlying authentication context.\nThe attack flow begins once the attacker successfully authenticates with the target account's primary password, triggering the MFA challenge. Instead of enforcing a global threshold for the specific user account (e.g., account lockout after 5 failed attempts), the system relies on transient, IP-based rate limiting. An attacker can circumvent this by utilizing distributed infrastructure—such as botnets, proxy networks, or rotating residential IP addresses—to distribute guessing attempts, ensuring no single IP address hits the system-defined threshold.\nDuring exploitation, the attacker repeatedly submits valid-format TOTP codes against the active MFA challenge ticket. Since the application does not enforce a strict limit on the number of attempts permitted per valid ticket or per user account, the attacker can effectively 'brute-force' the 6-digit TOTP secret. The technical failure lies in the application's verification logic, which processes each incoming request in isolation rather than maintaining a state-synchronized failure count for the specific account undergoing authentication.\nThis flaw allows for high-velocity guessing attacks that significantly reduce the time required to successfully guess a valid TOTP code. Because the system does not invalidate the challenge ticket or lock the account upon multiple failures, the attacker can continue the brute-force process until the correct code is identified. Successful exploitation grants the attacker full access to the account, bypassing the intended security guarantees of TOTP-based MFA, leading to complete account takeover."
}