Insecure Session Storage in Telegram-Stremio

Telegram-Stremio through version 5.1.0 is vulnerable to an insecure storage flaw that exposes authenticated Telegram session strings. Research indicates that the application utilizes a keyless, reversible encoding transform to store session data in its backend MongoDB database rather than applying robust encryption. Because this transformation requires no secret key, any adversary gaining access to the MongoDB instance, system backups, or diagnostic logs can trivially decode the stored strings. By injecting these decoded session strings into their own Telegram client, an attacker can hijack the operator's account. This method successfully bypasses two-step verification, as the session token represents an already authenticated state. This vulnerability poses a high risk to operators who rely on the application for integrated communications.

Impact

Successful exploitation allows for full, unauthorized control of the operator's Telegram account. Because the session token is already authenticated, the attacker circumvents two-step verification security measures. This impact is applicable to any environment running Telegram-Stremio through 5.1.0 where MongoDB data or application logs are reachable by unauthorized entities, potentially leading to widespread account compromise, exfiltration of private messages, and impersonation within the target's contacts.

Recommendation

• Immediately restrict access to the MongoDB database instances used by Telegram-Stremio to only authorized service accounts.
• Audit application and system logs for evidence of unauthorized access or exposure of sensitive session tokens.
• Monitor database backups for unauthorized egress or access, as these files contain the reversible session strings.
• Update to the latest version of Telegram-Stremio if a patch becomes available to address the insecure storage mechanism; currently, no patch is documented.