Skip to content
OpenAdvisories
Critical · 9.7 CVE-2025-52571 EUVD-2025-19067

Hikka vulnerable to RCE through edits in a channel

Published Jun 24, 2025 · Updated Jun 24, 2025 · Assigned by GitHub_M

Description

Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to gain access to Telegram account of a victim, as well as full access to the server. The issue is patched in version 1.6.2. No known workarounds are available.

Affected products

VendorProductAffectedFixed
hikariatama Hikka < 1.6.2 —

References