A critical path traversal vulnerability in fast-mcp-telegram, a popular MCP (Model Context Protocol) server for Telegram integration, allows remote attackers to bypass Bearer token authentication entirely and hijack the default Telegram session without ever knowing a valid token.
The flaw, tracked as GHSA-rxw2-pc8j-vxwm, affects all versions up to and including 0.19.0, with a patch released in version 0.19.1. The issue stems from how SessionFileTokenVerifier.verify_token() handles incoming Bearer tokens.
The verifier correctly blocks the exact reserved string “telegram” to prevent collisions with the default legacy session, but it fails to sanitize path separators or normalize the resulting file path before checking whether a session file exists.
fast-mcp-telegram Critical Flaw
This oversight lets an attacker submit a traversal-based token, such as ../fast-mcp-telegram/telegram, which resolves to the same file as the blocked default at ~/.config/fast-mcp-telegram/telegram.session.
The vulnerable logic appends the raw token directly into a filesystem path without canonicalization, using a pattern equivalent to joining the session directory with the token string and appending a .session extension, then simply checking if that file exists.
The same unsanitized pattern reappears in src/client/connection.py, where the session path is rebuilt for the Telegram client.
No code path rejects forward slashes, backslashes, double dots, or absolute paths, allowing directory traversal to reach files outside the intended token-scoped namespace entirely.
If a server has HTTP authentication enabled and a legacy or default telegram.session file exists, an unauthenticated attacker can impersonate that account entirely, without brute-forcing or guessing the actual generated token.
Once authenticated via the traversal alias, the attacker gains full access to Telegram MCP tools tied to that session. This includes reading and sending messages, making arbitrary MTProto API calls, and accessing attachment-producing tool surfaces available to the compromised account.
DavidCarliez confirmed that FastMCP’s account-prefix middleware, which labels tools according to the resolved account, does not mitigate this bypass.
Because the middleware operates downstream of authentication, it faithfully exposes prefixed tools for whichever account the traversal token resolves to, meaning the prefix system cannot restore the broken authentication boundary.
The literal token “telegram” is correctly denied, and a traversal token pointing to a nonexistent file is also denied, showing the basic controls function as intended in isolation.
However, the traversal alias ../fast-mcp-telegram/telegram is accepted, and the client builder subsequently receives the resolved default session path.
Prefixed tools, such as defaultalice_send_message, are then listed and callable for the traversal-authenticated account. This sequence confirms that the bug is a genuine session selection and authentication bypass, not merely a missing-prefix execution issue.
The GitHub advisory recommends enforcing a strict token format matching generated URL-safe base64 tokens, rejecting any token containing slashes, backslashes, dots, empty segments, or absolute paths.
The final session path should also be resolved and verified to remain a direct child of the configured session directory before granting access.
This validation must apply consistently across all authentication entry points, including URL auth middleware, setup flows, and session cleanup routines, alongside regression tests covering traversal aliases and encoded paths.
Administrators running fast-mcp-telegram in HTTP auth mode should upgrade to version 0.19.1 immediately. Those unable to patch right away should check for a default telegram.session file on their server and consider removing or relocating it as a temporary mitigation.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 server for Telegram integration, allows remote attackers to bypass Bearer token authentication entirely and hijack the default Telegram session without ever knowing a valid token.){kind=link}