Summary
stoatchat before 0.15.5 does not verify that an MFA ticket belongs to the authenticated user associated with a session. An attacker may combine a ticket from their own account with another user's session token to bypass MFA and perform sensitive account operations.
Affected context
The vulnerability occurs in stoatchat MFA workflows when the application accepts an MFA ticket without binding it to the identity represented by the active session. Deployments are at risk when session tokens and MFA tickets are processed through separate validation paths and sensitive operations, such as TOTP management or recovery-code access, rely on that incomplete association.
Exploit preconditions
- Attack surface: MFA-protected account-management or authentication endpoints
- Required access: A valid session token for the targeted user's session and a valid MFA ticket issued to an attacker-controlled account
- Trigger point: A sensitive MFA-related operation that consumes the ticket and session token
- Why exploitation is possible: The application validates the ticket's validity but does not sufficiently confirm that its subject matches the authenticated session user
Why this happens
The underlying flaw is an authorization failure caused by treating a valid MFA ticket as sufficient proof for a different authenticated principal. The application does not enforce an ownership or subject-binding check between the ticket and the session before authorizing sensitive actions. This maps to CWE-639, Authorization Bypass Through User-Controlled Key, because an attacker-controlled identity reference can influence authorization decisions without adequate validation against the authenticated user.
Potential impact
- An attacker may bypass the victim's MFA requirement
- An attacker could disable the victim's TOTP protection
- An attacker may view or obtain account recovery codes
- An attacker could perform other sensitive account-management operations
- The affected account could be exposed to further compromise
General mitigation guidance
Mitigation generally focuses on binding every MFA artifact to the intended
authenticated principal and authorization context.
Common defensive patterns include:
- Associate MFA tickets with an immutable user identity, session, purpose, and short validity period
- Verify that the ticket subject exactly matches the authenticated session user before every sensitive operation
- Use server-side state rather than trusting user-controlled identity references
- Require step-up authentication for changes to MFA settings and recovery credentials
- Apply least privilege and narrowly scoped permissions to MFA-management endpoints
- Invalidate tickets after use and prevent cross-session or cross-account reuse
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis and code review checks for authorization decisions based only on ticket validity
- Review of MFA handlers for missing subject, session, audience, purpose, and scope comparisons
- Tests that attempt to combine authentication artifacts from different accounts
- Monitoring for MFA changes, recovery-code access, or TOTP enrollment from unusual sessions
- Policy enforcement requiring explicit identity binding before sensitive authorization decisions
Automated security review tools may help identify ticket-consumption paths that lack
principal ownership validation.
