CVE-2026-109426

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-109427

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

CVE-2026-109427 Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

CVE-2026-109427 Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

EUVD-2026-97859

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

CVE-2026-109427

Telegram-Stremio versions through 5.1.0 are affected by a broken object-level authorization vulnerability. The root cause is the use of encode_string and decode_string functions to process unsigned, unauthenticated stream IDs. Authenticated token holders can exploit this by crafting or enumeratin...

CVE-2026-109426 Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-109426

Telegram-Stremio versions through 5.1.0 are vulnerable to an insecure storage flaw. The application fails to properly encrypt authenticated Telegram session strings, instead using a keyless, reversible encoding transform. Attackers who gain access to the MongoDB database , backups , or logs can u...

EUVD-2026-97910

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-109426 Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-109427: Authorization Bypass Through User-Controlled Key

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

CVE-2026-109426: Cleartext Storage of Sensitive Information

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

PT-2026-110930

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

PT-2026-110931

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode string/decode string functions. Attackers can craft or enumerate...