Description

stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-26T14:16:51.993Z",
  "pubdate": "2026-09-26T14:16:51.993Z",
  "executiveSummary": "The vulnerability in stoatchat versions prior to 0.15.5 constitutes an improper authentication validation flaw within the Multi-Factor Authentication (MFA) workflow.\nThe core issue arises from a failure to cryptographically or logically bind MFA tickets to the specific session token of the authenticated user.\nAn unauthenticated or authenticated attacker can leverage a valid MFA ticket generated from their own account to satisfy the MFA requirements of a victim's session.\nThis vulnerability allows for complete bypass of TOTP (Time-based One-Time Password) mechanisms, enabling unauthorized access to sensitive account configurations, including the ability to disable security settings or retrieve account recovery codes.\nThe impact is critical, as it effectively nullifies the protection provided by MFA, allowing attackers to escalate privileges or compromise user accounts without knowledge of the victim's primary credentials.\nExploitation requires the attacker to possess a valid MFA ticket from their own account and the victim's valid session token, which may be acquired through secondary means such as session hijacking or cross-site scripting.",
  "technicalDetails": "The vulnerability exists in the stoatchat authentication subsystem, specifically within the logic responsible for verifying MFA tickets during session elevation or sensitive configuration changes.\nThe root cause is a lack of server-side association between the MFA ticket and the authenticated user identity (UID) or the current session identifier (SID). The server verifies that an MFA ticket is structurally valid and not expired, but fails to verify that the ticket was issued specifically for the user account attempting the action.\nThe attack flow proceeds as follows: 1) The attacker initiates an MFA-protected action on their own compromised or controlled account to generate a valid MFA ticket from the stoatchat backend. 2) The attacker intercepts or identifies the victim's session token. 3) The attacker initiates the same sensitive operation (e.g., viewing recovery codes or disabling MFA) using the victim's session token. 4) When prompted for MFA, the attacker provides the MFA ticket obtained from their own account. 5) The stoatchat server verifies the ticket's general validity and, due to the missing binding check, erroneously links the attacker's ticket to the victim's session.\nBecause the server logic relies on the ticket's integrity rather than its ownership, the system authorizes the attacker's request as if the victim had provided the correct TOTP token. This bypass effectively allows the attacker to perform administrative actions on the victim's account, such as disabling MFA or exporting secret recovery keys.\nThis flaw is persistent in all stoatchat versions prior to 0.15.5. The vulnerability is highly exploitable, requiring minimal technical sophistication once the victim's session token is obtained. There is no requirement for the attacker to know the victim's password or possess a physical TOTP device linked to the victim's account. Post-exploitation impact includes full account takeover (ATO), where the attacker can maintain persistence by disabling secondary security controls, effectively locking the legitimate user out of their account."
}