CVE-2021-27351 Security feature bypass in n/a

Medium 5.3 Published 19 Feb 2021 Updated 3 Aug 2024

Attackers can maintain access to Telegram accounts because the Terminate Session feature fails to invalidate active sessions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-27351?

CVE-2021-27351 is a medium-severity vulnerability in n/a, published on 19 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session.

Weakness: CWE-613

Which versions are affected by CVE-2021-27351?

It affects 1 product.

Products include Telegram Telegram.

How do I fix CVE-2021-27351?

Upgrade to a fixed version.

Is CVE-2021-27351 being exploited?

There is no known exploitation of CVE-2021-27351 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2021-27351, GHSA-cc4r-2rwj-vx7x, UBUNTU-CVE-2021-27351.