{"id":56157,"date":"2025-06-30T23:45:52","date_gmt":"2025-06-30T23:45:52","guid":{"rendered":""},"modified":"2025-08-31T18:38:19","modified_gmt":"2025-09-01T00:38:19","slug":"cve-2025-52572-critical-vulnerability-in-hikka-telegram-userbot","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-52572-critical-vulnerability-in-hikka-telegram-userbot\/","title":{"rendered":"CVE-2025-52572: Critical Vulnerability in Hikka Telegram Userbot<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has identified a severe vulnerability, CVE-2025-52572, affecting all versions of the popular Telegram userbot, Hikka. This vulnerability has the potential to compromise entire systems and leak sensitive data, making it a pressing concern for all Hikka users. With a CVSS severity score of 10.0, the maximum possible, it represents a significant threat to the security<\/a> and privacy of users and their data.
\nThe vulnerability lies in the Hikka bot’s web<\/a> interface and can be exploited in two distinct scenarios. The first scenario occurs when the web interface lacks an authenticated session, allowing an attacker to use their Telegram account to gain remote code execution<\/a> (RCE) to the server. The second scenario involves an authenticated session, where a lack of sufficient warning in the authentication message tempts users to allow<\/a> potentially damaging actions.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-52572
\nSeverity: Critical (10.0 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise and data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n