CVE-2026-109427 Details

A broken object-level authorization vulnerability has been identified in Telegram-Stremio versions through 5.1.0. This vulnerability allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs. The stream IDs can be manipulated using the application's encoding and decoding functions. Exploitation involves crafting or sequentially enumerating message IDs and routing requests through the operator's personal Userbot account, which exposes private channels, groups, and Saved Messages. Additionally, an unauthenticated endpoint can be used to access thumbnails from these chats without any token validation.

It is recommended to implement proper signing of stream IDs, add object-level authorization checks, and encrypt sensitive information such as Telegram session strings before storing them.