stoatchat versions prior to 0.15.5 do not verify that a submitted MFA ticket belongs to the user who is authenticated, so attackers can submit a ticket issued for their own account together with a valid session token belonging to another user. This flaw allows the attacker to disable TOTP, view recovery codes, and carry out other sensitive operations without the victim’s credentials.

The vulnerability targets the stoatchat application for all releases before 0.15.5. Users running these older versions are exposed if they have MFA enabled and are using the built‑in ticket system for authentication.

The reported CVSS score of 7.1 indicates a high impact with moderate exploitation complexity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires an attacker to possess a valid MFA ticket from an account they control and the victim’s session token, a relatively straightforward requirement. Successful use of the vulnerability gives the attacker full control over the victim’s account and the ability to perform all actions that the account owner can normally do.