Stoatchat EUVD-2026-87651

Requires the attacker to ALREADY know the victim's password - the flaw only defeats the second factor (TOTP), not the first. Exploitation further requires that MFA/TOTP is enabled on the target account, and that the attacker can reuse a single MFA challenge ticket across many attempts while distributing guesses across multiple source IP addresses to evade the only mitigation present (per-IP rate limiting); there is no account-level attempt lockout. Limiting factors: password compromise is a hard prerequisite, distributed IP infrastructure is needed to defeat rate limiting, and the TOTP keyspace still bounds success probability per attempt. Affects all versions of stoatchat before 0.15.5.

The vendor CVSS 4.0 vector (8.3, AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L) frames this as network-reachable but non-trivial: AC:H and AT:P correctly capture that the attacker must ALREADY know the victim's password and must actively defeat IP-based rate limiting by reusing MFA challenge tickets and distributing TOTP guesses across many source IPs. PR:N is technically accurate (no account on the system is needed) but is somewhat misleading because prior password knowledge is a hard precondition - this is a second-factor-defeat issue, not a from-zero account takeover. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation; the realistic threat is targeted rather than opportunistic/mass exploitation. The 8.3 rating is on the high side for what is effectively a defense-in-depth erosion of the 2FA layer: it matters most for accounts whose passwords are already breached/phished, where MFA is the last barrier. Net: a genuine and correctly-classified weakness (CWE-307), but priority is moderate - gated behind password compromise, requiring resources (multiple IPs) and offering brute-force success against a 6-digit TOTP space that is large but bounded once rate limiting is neutralized.

An attacker who has already obtained a victim's stoatchat password (via phishing, reuse, or a prior breach) initiates login, receives an MFA challenge ticket, and then reuses that ticket while spraying TOTP guesses from a rotating pool of IP addresses to stay under the per-IP rate limit. Because no account-level attempt cap exists, they can iterate through TOTP codes until one succeeds, bypassing 2FA and gaining full account access. No public exploit code is identified at time of analysis; exploitation is straightforward to script but requires distributed infrastructure.