CVE-2026-109426

Received Received - Intake

Insecure Storage of Telegram Session in Telegram-Stremio

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109426

Affected Vendors & Products

Vendor	Product	Version / Range
weebzone	Telegram-Stremio	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

Telegram-Stremio through version 5.1.0 has an insecure storage vulnerability where the operator's authenticated Telegram session string is stored using a reversible encoding transform instead of proper encryption. Attackers with access to the MongoDB database, backups, or logs can recover this session string and use it to gain full control of the operator's Telegram account, even if two-step verification is enabled.

Detection Guidance

This vulnerability involves insecure storage of Telegram session strings in Telegram-Stremio's MongoDB database, backups, or logs. To detect it, inspect MongoDB collections for stored Telegram session strings, particularly those encoded with the decode_string function. Check logs for exposed session strings. No specific commands are provided in the context.

Impact Analysis

If you use Telegram-Stremio, attackers could gain unauthorized access to your Telegram account by exploiting this vulnerability. This could lead to misuse of your account, exposure of private conversations, or impersonation. The impact is severe as it bypasses two-step verification and grants complete control.

Compliance Impact

This vulnerability likely violates data protection and privacy regulations such as GDPR and HIPAA, which require proper encryption of sensitive session data. Failure to secure session strings could result in non-compliance, legal penalties, and loss of trust due to unauthorized access to user accounts.

Mitigation Strategies

Disable or remove Telegram-Stremio if in use. Review MongoDB databases, backups, and logs for exposed Telegram session strings. Rotate all Telegram session tokens and enable two-step verification if not already active.

Hi! I’m here to help you understand CVE-2026-109426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70