Vendor
Telegram-Stremio versions 5.1.0 and earlier store Telegram session strings using a reversible encoding transform, enabling attackers with database or log access to perform full account takeover.