Telegram-Stremio leaks reversible Telegram session strings
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
Telegram-Stremio through 5.1.0 stores the operator's authenticated Telegram session string protected only by a keyless, reversible encoding instead of encryption, which is cleartext storage of sensitive information (CWE-312). An attacker with access to the MongoDB database, backups, or logs can recover a fully authenticated Telegram session and take complete control of the operator's account, even when two-step verification is enabled.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Telegram-Stremio.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-12 Threatist record created from CVE-2026-109426
- 2026-10-13 Alias added: GHSA-f4vq-cf7c-pvmv
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-13 Priority changed: LOW → MEDIUM
References
Other 1
More weebzone vulnerabilities
- TI-2026-71285 Broken object authorization in Telegram-Stremio exposes private chats CVSS 4.0HIGH 7.1
Sources
- CVE-2026-109426 · CVE Program
- CVE-2026-109426 · NVD
- FIRST EPSS
- GHSA-f4vq-cf7c-pvmv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences