CVE-2026-100674

4.3 MEDIUMpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-180

Public exploit & PoC references

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5

All references

https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5
https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100230PoC
MEDIUMCVE-2026-100547PoC
MEDIUMCVE-2026-102269PoC
MEDIUMCVE-2026-95811
LOWCVE-2026-97764

Related by shared AI tags and CWE weakness class. Browse the full archive.