Description
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| stoatchat | stoatchat | < 0.15.5 | 0.15.5 |
References
- GitHub Security Advisory (GHSA-6877-g673-f5r8) vendor-advisory
- VulnCheck Advisory: stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting third-party-advisory