StoatChat EUVD-2026-87652

Exploitation requires two prerequisites: (1) the attacker must possess a valid authenticated stoatchat account of their own in order to mint a legitimate MFA ticket, and (2) the attacker must already hold a valid VICTIM session token - the flaw only bypasses the MFA step-up re-authentication that protects sensitive account operations (disabling TOTP, viewing recovery codes), it does not grant the session itself. There is no user interaction required from the victim. The limiting factor is the need to first obtain the victim's session token; without it, the ticket-ownership defect cannot be reached. Applies to any stoatchat instance running a version before 0.15.5.

This is a genuine but conditionally-gated MFA bypass (CWE-639, IDOR on MFA ticket ownership). The vendor CVSS 4.0 vector (7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) indicates a network-reachable, low-complexity, authenticated attacker with high confidentiality impact and no direct integrity/availability impact. The critical caveat NOT reflected in the raw CVSS is that exploitation requires the attacker to already possess a VICTIM'S valid session token - the flaw only defeats the step-up MFA re-authentication gate, it does not by itself grant session access. This meaningfully raises real-world complexity beyond the vendor's AC:L rating (I assess AC:H). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automatable exploitation - this is a real security-boundary defect but not an urgent widespread-exploitation priority. The VI:N rating also arguably understates impact, since disabling a victim's TOTP is a modification of account security state (integrity), and viewing recovery codes can enable downstream full account takeover.

An attacker who has obtained a victim's session token (e.g. via a stolen/leaked token or XSS) logs into their own stoatchat account, requests a valid MFA ticket, then replays that ticket alongside the victim's session token against a sensitive endpoint. Because the server never checks that the ticket belongs to the token's user, the attacker disables the victim's TOTP or reads their recovery codes without ever knowing the victim's MFA secret. No public exploit code is identified at time of analysis.