PT-2026-110931

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode string/decode string functions. Attackers can craft or enumerate...