CVE-2026-109426: Telegram-Stremio Information Disclosure

CVE-2026-109426 Overview

CVE-2026-109426 affects Telegram-Stremio through version 5.1.0. The application stores the operator's authenticated Telegram session string using a keyless, reversible encoding transform rather than real encryption. Any attacker who gains access to the MongoDB database, backups, or logs can reverse the stored value using the repository's own decode_string function. The result is a fully authenticated Telegram session, giving the attacker complete control of the operator's Telegram account even when two-step verification is enabled. The flaw is classified under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Attackers with read access to backend storage can recover a valid Telegram session and hijack the operator's account without credentials or 2FA interaction.

Affected Products

Telegram-Stremio through 5.1.0
Deployments storing session data in MongoDB
Any backup or log store that captured the encoded session string

Discovery Timeline

2026-10-12 - CVE-2026-109426 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109426

Vulnerability Analysis

Telegram-Stremio persists the operator's Telegram session string in MongoDB after wrapping it with a bespoke encode_string routine. The routine performs a reversible transform without a secret key, salt, or cryptographic primitive. The matching decode_string function reverses the transform deterministically and ships inside the same repository. An attacker who reads the stored value can therefore reconstruct the original session string using only code already published by the project. Telegram session strings are long-lived bearer credentials. Possession of a valid session string grants complete, authenticated access to the account, bypassing password prompts and two-step verification challenges because the server treats the session as already authenticated.

Root Cause

The root cause is cleartext storage of sensitive information disguised as encryption. The encode_string function provides obfuscation only. There is no key material, so confidentiality depends entirely on the secrecy of the storage layer. This violates the standard practice of encrypting authentication tokens at rest with a key held outside the database.

Attack Vector

Exploitation requires read access to the MongoDB collection holding session records, a database backup, or application logs that captured the encoded value. Access routes include compromised database credentials, exposed MongoDB instances, stolen backup archives, log aggregation platforms, and insider access. After retrieving the stored string, the attacker runs it through decode_string and loads the resulting session into any Telegram client library to assume the operator's identity.

Technical details and proof-of-concept code are published in the VulnCheck Security Advisory and a GitHub Gist PoC.

Detection Methods for CVE-2026-109426

Indicators of Compromise

Unexpected Telegram login notifications or new active sessions on the operator account.
Access to the Telegram-Stremio MongoDB instance from unfamiliar IP addresses or service accounts.
Reads against the collection storing session records outside of normal application activity.
Presence of Telegram-Stremio backup archives or log files on hosts that should not hold them.

Detection Strategies

Audit MongoDB query logs for reads of the session collection by non-application identities.
Correlate Telegram account activity, including device additions and session resets, with backend database and backup access events.
Scan log pipelines and object storage for strings matching the encode_string output format.

Monitoring Recommendations

Enable MongoDB auditing for authentication events and collection-level access.
Forward Telegram-Stremio application logs to a central platform and alert on dumps of the session collection.
Monitor backup repositories for unauthorized downloads or copies.

How to Mitigate CVE-2026-109426

Immediate Actions Required

Log out all active Telegram sessions from the affected operator accounts and rotate the session by re-authenticating.
Treat any existing MongoDB export, backup, or log containing the encoded session string as compromised and purge or re-encrypt it.
Restrict MongoDB network exposure and enforce strong authentication for all database users.
Review access to backups and log aggregation platforms and revoke unneeded permissions.

Patch Information

No vendor patch is referenced in the enriched CVE data at the time of writing. Monitor the VulnCheck Security Advisory for updates and apply any upstream fix that replaces encode_string with authenticated encryption using an external key.

Workarounds

Encrypt the session field at the application layer using a vetted library and a key held in a secrets manager rather than the database.
Use MongoDB field-level or client-side encryption for the session collection so stored values are unreadable without the key.
Enable encryption at rest for MongoDB storage and backups and restrict decryption keys to the application host.
Reduce log retention and scrub session identifiers from logs produced by Telegram-Stremio.

bash

# Example: restrict MongoDB access and enable TLS
# /etc/mongod.conf
net:
  bindIp: 127.0.0.1
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/ssl/mongodb.pem
security:
  authorization: enabled
  enableEncryption: true
  encryptionKeyFile: /etc/mongodb/keyfile