CVE-2026-109427: Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate sequential msgid values and set a global flag in the streamhandler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumbhandler endpoint further discloses thumbnails from those same chats without any token validation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to message disclosure?
Any deployment running Telegram-Stremio through 5.1.0 is affected. Authenticated holders of a token can access arbitrary messages from private channels, groups, and Saved Messages reachable through the operator's personal Userbot account.
What does an attacker need to exploit the message-access issue?
The attacker needs a valid authentication token for the stream_handler endpoint. They can forge unsigned stream IDs, craft or enumerate sequential msg_id values, and set the global flag to route requests through the operator's Userbot account.
Can data be exposed without authentication?
Yes. The thumb_handler endpoint does not validate tokens and can disclose thumbnails from the same chats without authentication.
How can an organization determine whether it may be affected?
Review whether Telegram-Stremio is deployed at version 5.1.0 or earlier and whether its Userbot account has access to private channels, groups, or Saved Messages. Also assess whether the stream_handler and thumb_handler endpoints are reachable by untrusted users or networks.