https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 19:03:18 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-109426 <p>Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator&#39;s authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository&#39;s own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator&#39;s Telegram account even when two-step verification is enabled.</p> <p>Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator&#39;s authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository&#39;s own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator&#39;s Telegram account even when two-step verification is enabled.</p> https://db.gcve.eu/vuln/fkie_cve-2026-109426 https://db.gcve.eu/vuln/ghsa-f4vq-cf7c-pvmv <p>Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator&#39;s authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository&#39;s own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator&#39;s Telegram account even when two-step verification is enabled.</p> <p>Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator&#39;s authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository&#39;s own decode_string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator&#39;s Telegram account even when two-step verification is enabled.</p> https://db.gcve.eu/vuln/ghsa-f4vq-cf7c-pvmv