{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atelegram_stremiotelegram_stremio/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:telegram_stremio:telegram_stremio:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109426"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Telegram-Stremio (\u003c= 5.1.0)"],"_cs_severities":["high"],"_cs_tags":["credential-access","insecure-storage","session-hijacking"],"_cs_type":"advisory","_cs_vendors":["Telegram-Stremio"],"content_html":"\u003cp\u003eTelegram-Stremio through version 5.1.0 is vulnerable to an insecure storage flaw that exposes authenticated Telegram session strings. Research indicates that the application utilizes a keyless, reversible encoding transform to store session data in its backend MongoDB database rather than applying robust encryption. Because this transformation requires no secret key, any adversary gaining access to the MongoDB instance, system backups, or diagnostic logs can trivially decode the stored strings. By injecting these decoded session strings into their own Telegram client, an attacker can hijack the operator's account. This method successfully bypasses two-step verification, as the session token represents an already authenticated state. This vulnerability poses a high risk to operators who rely on the application for integrated communications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full, unauthorized control of the operator's Telegram account. Because the session token is already authenticated, the attacker circumvents two-step verification security measures. This impact is applicable to any environment running Telegram-Stremio through 5.1.0 where MongoDB data or application logs are reachable by unauthorized entities, potentially leading to widespread account compromise, exfiltration of private messages, and impersonation within the target's contacts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict access to the MongoDB database instances used by Telegram-Stremio to only authorized service accounts.\u003c/li\u003e\n\u003cli\u003eAudit application and system logs for evidence of unauthorized access or exposure of sensitive session tokens.\u003c/li\u003e\n\u003cli\u003eMonitor database backups for unauthorized egress or access, as these files contain the reversible session strings.\u003c/li\u003e\n\u003cli\u003eUpdate to the latest version of Telegram-Stremio if a patch becomes available to address the insecure storage mechanism; currently, no patch is documented.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:41:55Z","date_published":"2026-10-12T22:41:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-telegram-stremio-insecure-storage/","summary":"Telegram-Stremio versions 5.1.0 and earlier store Telegram session strings using a reversible encoding transform, enabling attackers with database or log access to perform full account takeover.","title":"Insecure Session Storage in Telegram-Stremio","url":"https://feed.craftedsignal.io/briefs/2026-10-telegram-stremio-insecure-storage/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:telegram_stremio:telegram_stremio:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}