CVE-2026-52830

## Summary fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token `telegram`, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legacy session with a token such as `../fast-mcp-telegram/telegram` when the documented default session file `~/.config/fast-mcp-telegram/telegram.session` exists. This bypasses the reserved session name control that is intended to prevent HTTP multi-user sessions from colliding with the default stdio or legacy account. With account-prefixed MCP tools enabled, the attacker still sees and calls the prefixed tools for the default account, so the prefix middleware does not stop the session selection bypass. ## Impact An unauthenticated network client can access the Telegram account represented by the default `telegram.session` file without knowing a generated bearer token, if that legacy or default session file is present on a server running HTTP auth. The attacker can then call Telegram MCP tools as that account, including message reading, message sending, MTProto API calls, and attachment-producing tool surfaces available to the session. ## Technical details `SessionFileTokenVerifier.verify_token()` strips whitespace and rejects exact reserved names: ```python if token.lower() in RESERVED_SESSION_NAMES: return None ``` It then appends `.session` to the raw token and checks the resulting path: ```python session_path = self._session_directory / f"{token}.session" if not session_path.is_file(): return None ``` No check rejects `/`, `\\`, `..`, absolute paths, or resolved paths outside the configured session directory. The session client path is built the same way in `src/client/connection.py`: ```python session_path = SESSION_DIR / f"{token}.session" client = await _build_telegram_client_for_token(session_path,