stoatchat Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

stoatchat5 vulnerabilities
Stoat for Android1 vulnerability

stoatchat vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-63088HIGH	stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url_is_blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses. CWE-918Jul 16, 2026	CVSS7.7v4.0	EPSS0.371%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-58360MEDIUM	stoatchat before 0.7.8 Unrestricted Account Creation stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification. Attackers can create unlimited accounts with unverified email addresses, increasing denial-of-service risk and compromising service integrity. CWE-1173Jul 16, 2026	CVSS6.9v4.0	EPSS0.259%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-63306CRITICAL	stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure. CWE-918Jul 16, 2026	CVSS9.2v4.0	EPSS0.241%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-71388HIGH	stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens, because the webhook fetch endpoint checked for ViewChannel instead of ManageWebhooks. Using a retrieved token, an attacker can send arbitrary messages to the channel, bypassing channel permissions and impersonating a bot or webhook. Fixed in 20250210-1 (0.8.2). CWE-639Jul 16, 2026	CVSS7.6v4.0	EPSS0.275%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-71377HIGH	stoatchat before 20250210-1 Unrestricted Message History Fetch stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the database query can be given a message limit of zero, which the database interprets as 'no limit'. A remote unauthenticated attacker can craft nearby message fetch requests to download an entire channel's message history in a single expensive request, and can send many such requests in parallel, resulting in denial of service through resource… CWE-1025Jul 16, 2026	CVSS8.7v4.0	EPSS0.383%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX