Remote Code Execution Vulnerability in Hikka Telegram Userbot

CVE-2025-52572

What is CVE-2025-52572?

The Hikka Telegram userbot has a remote code execution vulnerability that affects all users across all versions. This vulnerability presents two scenarios for exploitation: in the first scenario, if the web interface lacks an authenticated session, an attacker can leverage their own Telegram account to gain unauthorized access to the server. In the second scenario, when an authenticated session does exist, insufficient warnings during authentication can mislead users into granting permission to a malicious web application, resulting in unauthorized access not only to remote code execution but also to the owners' Telegram accounts. Scenario two has been observed in active exploitation. Currently, no patches are available, but users are advised to implement workarounds such as using the --no-web flag and ensuring they do not start the userbot without it, while also being cautious about clicking 'Allow' in the helper bot unless it is a specific and necessary action.

References