Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2018-15542: Telegram Android app lets anyone log in with any passcode
CVE-2018-15542 · published 8 years ago
Summary
The Telegram app version 4.8.11 for Android mistakenly allows the passcode check to be fooled, so a user could log in with any code. This can happen only on phones that have been altered (rooted) to change how the app runs. Update the app to a newer version and keep devices unrooted to stay protected.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| telegram | telegram |
4.8.11 cpe:2.3:a:telegram:telegram:4.8.11:*:*:*:*:android:*:* |
Original advisory text
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's retur...
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
References
- https://gist.github.com/tanprathan/18d0f692a2485acfb5693e2f6dabeb5d Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-287Improper Authentication
Timeline
Published9 Oct 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-15542 · NVD
Track software like this
Free during beta