CVE-2026-109426: Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string
Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decodestring function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to account takeover?
Operators whose authenticated Telegram session string is stored by Telegram-Stremio are exposed if an attacker can access the MongoDB database, database backups, or logs containing the stored value.
What does an attacker need to recover the session?
The attacker needs the stored encoded session value. No secret key is required because the repository's decode_string function can reverse the transform.
Does Telegram two-step verification prevent this takeover?
No. The recovered value is a fully authenticated Telegram session string, and the issue can grant complete control of the operator's Telegram account even when two-step verification is enabled.
How can I determine whether stored session data should be considered compromised?
Treat the session as exposed if the MongoDB database, its backups, or logs containing the encoded session value were accessible to an attacker. The available information does not provide a way to distinguish safe encoded values from already recovered ones.