CVE-2025-52572: Hikka Telegram Userbot RCE Vulnerability

CVE-2025-52572 Overview

CVE-2025-52572 is a critical Authentication Bypass vulnerability affecting Hikka, a Telegram userbot framework. This vulnerability enables attackers to achieve Remote Code Execution (RCE) on servers running Hikka through its web interface, with two distinct exploitation scenarios. In the first scenario, when the web interface lacks an authenticated session, attackers can use their own Telegram account to authorize against the dangling web interface and gain RCE access. In the second scenario, due to insufficient warning in the authentication message, users are tempted to click "Allow" in the "Allow web application ops" menu, granting attackers both RCE capabilities and access to the Telegram accounts of the userbot owners.

Critical Impact

This vulnerability has been exploited in the wild and allows complete server compromise with potential Telegram account takeover. No official patches are currently available.

Affected Products

• Hikka Telegram Userbot (all versions)

Discovery Timeline

• 2025-06-24 - CVE CVE-2025-52572 published to NVD
• 2025-06-26 - Last updated in NVD database

Technical Details for CVE-2025-52572

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication), indicating fundamental flaws in the authentication mechanism of Hikka's web interface. The vulnerability presents two attack scenarios that allow unauthorized access to the server and potentially the user's Telegram account.

The first scenario exploits a dangling web interface—when Hikka's web server is accessible without an authenticated session, any attacker can connect using their own Telegram credentials. This creates an authentication bypass where the attacker effectively becomes an authorized user on the target server, enabling arbitrary code execution within the Hikka environment.

The second scenario leverages social engineering combined with insufficient security warnings. The "Allow web application ops" prompt does not adequately communicate the security implications of clicking "Allow," leading users to inadvertently grant extensive permissions. This attack vector has been confirmed as actively exploited in the wild, demonstrating its practical effectiveness.

Root Cause

The root cause stems from improper authentication controls in Hikka's web interface. The application fails to properly restrict access to the web interface endpoints and does not provide adequate security context in authentication prompts. This allows unauthorized Telegram accounts to authenticate against exposed web interfaces and enables privilege escalation through deceptive authorization requests.

Attack Vector

The attack is conducted over the network with no authentication required. An attacker can exploit this vulnerability by:

1. Identifying exposed Hikka web interfaces on the internet
2. Connecting to the dangling web interface using their own Telegram account credentials
3. Leveraging the authenticated session to execute arbitrary code on the target server

Alternatively, attackers can trick legitimate users into clicking "Allow" on malicious authorization requests, which grants the attacker remote code execution capabilities and access to the victim's Telegram account.

For technical details on the vulnerability mechanism, see the GitHub Security Advisory and the related Telegram Post.

Detection Methods for CVE-2025-52572

Indicators of Compromise

• Unauthorized Telegram account authentications in web interface logs
• Unexpected "Allow web application ops" authorization events
• Unusual outbound connections from the Hikka server
• New or modified userbot modules not installed by the owner

Detection Strategies

• Monitor for exposed Hikka web interfaces on network ports
• Review authentication logs for unfamiliar Telegram account IDs
• Alert on any "Allow web application ops" authorization requests from unknown sources
• Implement network traffic analysis to detect command-and-control communications

Monitoring Recommendations

• Enable verbose logging for the Hikka web interface component
• Deploy network monitoring to identify exposed web interface ports
• Audit all Telegram authorization events and cross-reference with expected activity
• Monitor for unexpected file changes or new module installations in the Hikka directory

How to Mitigate CVE-2025-52572

Immediate Actions Required

• Start Hikka with the --no-web flag to disable the vulnerable web interface entirely
• Close the web interface port on the server firewall after authorization
• Do not click "Allow" in the helper bot unless it corresponds to an explicit action you initiated
• Review recent authorizations for suspicious activity

Patch Information

No official patches are currently available for CVE-2025-52572. Users are strongly advised to implement the workarounds described below and monitor the GitHub Security Advisory for patch announcements.

Workarounds

• Use the --no-web flag when starting Hikka to completely disable the web interface
• If web interface access is required, close the server port immediately after completing authorization
• Never click "Allow" in the helper bot unless you are certain the request originated from your own action
• Consider network-level restrictions to limit access to the web interface to trusted IP addresses only

# Start Hikka with web interface disabled
python -m hikka --no-web

# After authorization (if web was required), close the port
# Example using ufw firewall
sudo ufw deny 8080/tcp

# Example using iptables
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP