Threat database

Telegram-Stremio through version 5.1.0 suffers from an authorization bypass vulnerability that allows authenticated users to access arbitrary chat messages by forging stream IDs. This flaw enables attackers to enumerate message IDs and exploit a global flag to route requests through the operator's Userbot account, exposing private chats and saved messages. Additionally, an unauthenticated endpoint leaks chat thumbnails without token validation.

Telegram-Stremio versions up to 5.1.0 store the operator's authenticated Telegram session string insecurely in a MongoDB database, backups, or logs. The session string is protected only by a reversible encoding without a secret key, allowing attackers with access to these storage locations to recover it. This vulnerability enables attackers to fully authenticate as the operator on Telegram, even bypassing two-step verification.