High
stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
Type: advisorySource: Official CVE List
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a t…
Products: stoatchatCVEs: CVE-2026-100679