PT-2025-23112 · Unknown · Telemessage

Micah Lee · Published 2025-05-28 · Updated 2025-10-22 · CVE-2025-48929

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeleMessage service through 2025-05-05

Description The issue concerns the implementation of authentication through a long-lived credential in the TeleMessage service, which can be reused if discovered by an adversary. This has been exploited in the wild in May 2025.

Recommendations For the TeleMessage service through 2025-05-05, consider implementing short-lived authentication tokens to minimize the risk of credential reuse. As a temporary workaround, restrict access to sensitive features that rely on the long-lived credential until a more secure authentication mechanism is implemented.

Fix

Insufficient Session Expiration

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-613

CWE-922

Related Identifiers

CVE-2025-48929

Affected Products

Telemessage

References · 6

• https://osv.dev/vulnerability/CVE-2025-48929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48929 · Security Note
• https://t.me/cveNotify/139859 · Telegram Post
• https://twitter.com/CVEnew/status/1927775557560782867 · Twitter Post
• https://t.me/cvetracker/24840 · Telegram Post
• https://wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes · Note