Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109426Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string

High 7.5

In plain English

A high-severity security flaw in Telegram-Stremio from weebzone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.1%top 98.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.

Affected products (as reported)

Vendor	Product	Versions
weebzone	Telegram-Stremio	0 – through 5.1.0

Weakness: CWE-312 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Researcher Disclosure technical-description
VulnCheck Advisory: Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string third-party-advisory