The defect arises because stoatchat versions prior to 0.15.5 do not re‑validate usernames after Unicode normalisation. As a result an attacker can submit a Unicode string that is normalised to a forbidden character sequence after sanitisation, sidestepping the server‑side allowlist and length limit checks. This allows the creation of reserved‑name lookalikes, embedding of special characters, and usernames that exceed the 32‑character storage bound. The effect is a username validation bypass that can lead to user impersonation, confusion over account ownership, and potential abuse of privileged accounts if role assignment relies on the name.

The affected product is the stoatchat chat application. Versions earlier than 0.15.5 are vulnerable; the fix is provided in 0.15.5. Only the stoatchat product vendor stoatchat is affected as listed.

The CVSS score of 5.3 indicates a moderate severity. EPSS is unavailable and the issue is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack vector is inferred to be remote, via the application's user registration or profile update features that accept arbitrary Unicode input. No additional handling restrictions are mentioned in the advisory beyond the version limit.