PT-2025-26779 · Hikka · Hikka

Hikariatama · Published 2025-06-24 · Updated 2025-06-25 · CVE-2025-52571

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Hikka versions prior to 1.6.2

Description: A vulnerability in Hikka Telegram userbot allows an unauthenticated attacker to gain access to a victim's Telegram account and full access to the server. The issue affects all users of versions below 1.6.2, including most of the forks.

Recommendations: For versions prior to 1.6.2, update to version 1.6.2 to patch the issue. As a temporary workaround, consider restricting access to sensitive features until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-52571

GHSA-VWPQ-WM8W-44WF

Affected Products

Hikka

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52571.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52571 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52571 · Vendor Advisory
• https://github.com/hikariatama/Hikka/commit/9a0e4b1b387ef828c345c43d990421d5afcff5f6 · Note
• https://github.com/hikariatama/Hikka/security/advisories/GHSA-vwpq-wm8w-44wf · Note
• https://twitter.com/CVEnew/status/1937606218731659612 · Twitter Post
• https://t.me/cvetracker/26975 · Telegram Post
• https://t.me/purp_sec/812 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1937639669623095550 · Twitter Post
• https://twitter.com/CveFindCom/status/1937611865468641559 · Twitter Post