Telegram-Stremio versions up to 5.1.0 store the operator’s Telegram session string in a MongoDB database using a reversible encoding function without a secret key. An attacker who can read the database, backups, or logs can decode the stored value and obtain a fully authenticated Telegram session, thereby taking complete control of the operator’s Telegram account even when two‑step verification is enabled. The vulnerability is a classic example of improper cryptographic handling (CWE‑312).

The affected product is Weebzone’s Telegram‑Stremio, specifically version 5.1.0. The vendor product pairing is Weebzone:Telegram‑Stremio, and all installations of this version are impacted unless mitigated by configuration changes.

The CVSS score of 8.2 indicates a high severity risk. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, so the exploit probability is uncertain but potentially significant for systems with exposed database access. The likely attack vector requires the attacker to have database or backup access; once that is obtained, the session token can be recovered with no additional secret. Successful exploitation leads to full control of the operator’s Telegram account, presenting a critical threat to communications and potential downstream systems.