CVE-2026-109427

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

EUVD-2026-97859

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...

CVE-2026-109427

Telegram-Stremio versions through 5.1.0 are affected by a broken object-level authorization vulnerability. The root cause is the use of encode_string and decode_string functions to process unsigned, unauthenticated stream IDs. Authenticated token holders can exploit this by crafting or enumeratin...

CVE-2026-109427 Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...