Is CVE-2026-100678 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-100678?

CVE-2026-100678 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-100678

Description

stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.