CVE-2026-109427 debrief based on the supplied source corpus. The CVE record was published on 2026-10-12T20:35:49.858Z and has not been modified since then. This broken object authorization vulnerability in Telegram-Stremio 5.1.0 allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. The vulnera [truncated]
CVE-2026-109426: Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string. The vulnerability allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string. This is due to the use of a keyless, reversible encoding transform rather than actual encryption. As a result, attackers can obtain a fully authenticated Telegram session [truncated]
