Telegram-Stremio EUVD-2026-97910

Exploitation requires that the attacker already has read access to one of the backend data stores holding the Telegram session string - the MongoDB database contents, a database backup, or application logs - and that the operator has previously logged in so a session string is actually stored. Once that data is in hand, no cryptographic key is needed: the stored value is reversed using the repository's own decode_string function, and the recovered session works even when two-step verification is enabled. The key LIMITING factor is this prerequisite access to backend storage: there is no remotely triggerable path against a running default deployment, which is precisely why the CVSS 4.0 vector carries AT:P. Impact is confined to confidentiality/credential disclosure leading to operator Telegram account takeover.

The input CVSS 4.0 score of 8.2 (High) is driven by AV:N, AC:L, PR:N, UI:N and VC:H, but the single most important mitigating signal is AT:P (Attack Requirements: Present) - this is NOT a remotely triggerable flaw against a running service. Exploitation is strictly a post-compromise/secondary disclosure: the attacker must FIRST obtain access to the MongoDB database contents, database backups, or application logs. In other words, the CVSS 'network, no-privilege, no-interaction' framing overstates real-world reachability; the AT:P metric and the description together show that an attacker who already holds the stored data can trivially recover a fully authenticated Telegram session because it is only reversibly encoded, not encrypted (CWE-312). No EPSS score was provided, so statistical exploitation probability cannot be stated. KEV status is not present in the input, so this is NOT confirmed actively exploited. A public gist is referenced which may constitute a write-up or proof-of-concept, but no explicit POC flag was supplied, so it is not independently confirmed here. Combined with a very small deployment footprint (niche self-hosted hobby project), this is best treated as a genuine confidentiality/credential-exposure weakness but a LOW operational priority rather than a mass-exploitation threat: it only matters once an attacker already has database, backup, or log access.

An attacker who obtains a leaked MongoDB backup, gains read access to the database, or harvests application logs locates the stored Telegram session string, which is protected only by a keyless, reversible encoding. They round-trip that value through the application's own decode_string function with no secret key and obtain a fully authenticated session, taking over the operator's Telegram account even if two-step verification is enabled. A referenced public gist may demonstrate this, though active exploitation is not confirmed.