CVE-2026-109426 Details

A vulnerability exists in Telegram-Stremio versions through 5.1.0, allowing unauthorized access to the operator's authenticated Telegram session string. This session string is stored insecurely, protected only by a keyless, reversible encoding, rather than proper encryption. Attackers with access to the MongoDB database, backups, or logs can exploit this vulnerability by decoding the session string using the repository's decode_string function, without needing a secret key. This exploitation grants full control over the operator's Telegram account, even with two-step verification enabled.

It is recommended to encrypt the Telegram session string with a key from the environment, rather than from the database. Additionally, the encoding function should be replaced with a method that provides confidentiality, such as using a library that supports secure encryption.