CVE-2025-52571CWE-287

Hikka vulnerable to RCE through edits in a channel

Critical · published June 24, 2025

CVSS v3.1
9.7
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

🚨 A vulnerability lurking in Hikka could let an attacker waltz right into your Telegram account, grabbing full access to your server! Think of it like a delivery service that accidentally gives out the keys to your entire building. One wrong package and anyone can waltz in, snoop around, and even take your valuables! The consequences could be absolutely devastating! An attacker gaining access to your Telegram account could impersonate you, access sensitive conversations, and even manipulate your server settings. It's like someone wearing your identity badge and wreaking havoc in your organization! 🔥

Put simply

Think of it like a delivery service that accidentally gives out the keys to your entire building. One wrong package and anyone can waltz in, snoop around, and even take your valuables! This vulnerability in Hikka allows unauthenticated attackers to gain unauthorized access to Telegram accounts and server functionalities. It affects all users below version 1.6.2, including many forks, essentially creating a massive security hole that invites intruders.

What to do

The consequences could be absolutely devastating! An attacker gaining access to your Telegram account could impersonate you, access sensitive conversations, and even manipulate your server settings. It's like someone wearing your identity badge and wreaking havoc in your organization! 🔥 Immediate action is crucial! Upgrade Hikka to version 1.6.2 to patch this vulnerability without delay. Since there are no known workarounds, ensure you also review your security practices related to account access and server management. 🛡️ You’ve got this! Take these steps and you’ll be back in control in no time! 🚀

The record
Technical detail
CVSS v3.1
9.7 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-06-24T20:07Z
EPSS history
Timeline
  • 24 JUN 20:07Z
    Hikka vulnerable to RCE through edits in a channel
    cvelistv5