[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571901-105":53,"doc-detail-571901-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","tenet-telegram-mini-app-security-auditing","TENET - TELEGRAM MINI APP SECURITY AUDITING","","Telegram’s Mini Apps are web-based applications running inside the Telegram client, but this integration creates serious security risk for users and finances. Many Mini Apps store authentication secrets such as session tokens and wallet mnemonic phrases in plaintext on client devices, enabling unauthorized access, impersonation, and wallet exploitation. This work presents TENET, an auditing tool validating entropy and charset patterns, screening 61 Mini Apps, finding flaws in most analyzed apps, and documenting severity tiers including plaintext storage, recoverable encryption, and replayable tokens.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/tenet-telegram-mini-app-security-auditing/571901/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/tenet-telegram-mini-app-security-auditing/571901.png","ImageObject",442,249,{"name":88,"@type":89},"Pentious","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-21","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What security issues do the authors identify in Telegram Mini Apps?","Question",{"text":109,"@type":110},"The paper shows that many Mini Apps store authentication materials such as session tokens and wallet mnemonic phrases in plaintext or with weak protection, enabling unauthorized access, impersonation, and financial exploitation.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"What is TENET, and how does it work?",{"text":114,"@type":110},"TENET is a purpose-built auditing tool that uses design choices like pattern selection, entropy thresholds, and charset validation grounded in secret structure properties. It screens Mini Apps using a stratified, popularity-weighted approach.",{"name":116,"@type":107,"acceptedAnswer":117},"How severe are the vulnerabilities found, and what categories are used?",{"text":118,"@type":110},"Among analyzed applications, most exhibited flaws categorized into three severity tiers: plaintext storage, recoverable encryption, and replayable tokens. The official Wallet is reported to have had a critical vulnerability involving plaintext recovery mnemonics.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},571901,1792019411,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":35,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":101},1374404730887,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","TENET: TELEGRAM MINI APP (IN)SECURITY  \nANDREA CICCOTELLI 1 , FEDERICO ZAPPONE2 , AND ROBERTO DI PIETRO 1   \narXiv : 2608 . 17538v 1 [cs .CR] 18 Aug 2026  \n1 King Abdullah University of Science and  \nTechnology (KAUST)  \nComputer, Electrical and Mathematical Sciences and Engineering (CEMSE) Division Thuwal 23955, Saudi Arabia  \n[andrea.ciccotelli@kaust.edu.sa](andrea.ciccotelli@kaust.edu.sa)[ ](andrea.ciccotelli@kaust.edu.sa)[roberto.dipietro@kaust.edu.sa](roberto.dipietro@kaust.edu.sa)  \n2 Artificialy Lugano, Switzerland  \n[federico.zappone@artificialy.com](federico.zappone@artificialy.com)  \nAbstract. Telegram, with over 450 million daily active users, has introduced Mini Apps—web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials—such as session tokensand wallet mnemonic phrases—in plaintext on client devices, exposing users to unauthorized access, impersonation, and financial exploitation. While insecure client-side storage is a known risk in web applications, the Telegram Mini App ecosystem presents a uniquely dangerous combination of factors absent from prior work: no platform-level security review, no storage access restrictions, a financially motivated user base handling live cryptocurrency assets, and a WebView environment that offers weaker protections than standalone browsers. To investigate this threat, we present TENET, a purpose-built auditing tool whose design decisions—pattern selection, entropy thresholds, and charset validation—are grounded in the structural properties of the secrets targeted and empirically validated against aground-truth dataset. We screened 61 Mini Apps using a stratified, popularity-weighted sampling strategy. Of the 37 applications that met our processing criteria and were analyzed, 30 exhibited security flaws, which we classify into three severity tiers: plaintext storage, recoverable encryption, and replayable tokens. Notably, even Telegram’s official Wallet exhibits a severe vulnerability that may lead to full account compromise. Following our responsible disclosure, Telegram implemented two new secure-storage APIs, and our post-remediation verification confirmed that its official Wallet no longer exposes the recovery mnemonic in plaintext. Finally, we propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.  \nContents  \n1. Introduction 1  \n2. Related Work 2  \n3. Technology Background 3  \n3.1. Architecture of Telegram Mini Apps 4  \n3.2. Data Storage and Integration Flow 4  \n4. Mini Apps Security Analysis 4  \n4.1. Threat Model 5  \n4.2. Cryptocurrency-related Mini Apps 6  \n4.3. Wallet Mini Apps 6  \n4.4. Remote Data Exfiltration PoC 8  \n5. TENET 8  \n5.1. TENET Rationale and Architecture 8  \n5.2. TENET Execution Flow 9  \n5.3. TENET Evaluation 10  \n6. Experimental Results 11  \n6.1. Testbed 11  \n6.2. Results Analysis 11  \n7. Discussion 13  \n8. Conclusion 15  \nEthics and Privacy Statement 15  \nReferences 16  \n1. Introduction  \nSince its release in 2013, the cloud-based messaging and communication platform Telegram [12] has evolved far beyond a simple messaging service to become a comprehensive ecosystem that hosts a diverse range of integrated applications, known as Mini Apps [12] . These applications are built using standard web technologies (HTML, JavaScript, and CSS) and are embedded directly within the Telegram client. They leverage a controlled set of APIs to offer functionalities that range from basic  \n2  \ninformation retrieval to complex financial transactions while maintaining a seamless user experience within a single unified interface.  \nIntegrating Mini Apps into Telegram has enabled external developers to innovate rapidly. However, this architectural convergence of native and web-based components gives rise to a complex security landscape. Telegram protects ordinary Cloud Chats through cli","cbCaiabzDWpjdOnN","https://ap.wps.com/l/cbCaiabzDWpjdOnN","pdf",451717,"English","# Introduction\n# Related Work\n# Technology Background\n## Architecture of Telegram Mini Apps\n## Data Storage and Integration Flow\n# Mini Apps Security Analysis\n## Threat Model\n## Cryptocurrency-related Mini Apps\n## Wallet Mini Apps\n## Remote Data Exfiltration PoC\n# TENET\n## TENET Rationale and Architecture\n## TENET Execution Flow\n## TENET Evaluation\n# Experimental Results\n## Testbed\n## Results Analysis\n# Discussion\n# Conclusion\n# Ethics and Privacy Statement\n# References","[{\"question\":\"What security issues do the authors identify in Telegram Mini Apps?\",\"answer\":\"The paper shows that many Mini Apps store authentication materials such as session tokens and wallet mnemonic phrases in plaintext or with weak protection, enabling unauthorized access, impersonation, and financial exploitation.\"},{\"question\":\"What is TENET, and how does it work?\",\"answer\":\"TENET is a purpose-built auditing tool that uses design choices like pattern selection, entropy thresholds, and charset validation grounded in secret structure properties. It screens Mini Apps using a stratified, popularity-weighted approach.\"},{\"question\":\"How severe are the vulnerabilities found, and what categories are used?\",\"answer\":\"Among analyzed applications, most exhibited flaws categorized into three severity tiers: plaintext storage, recoverable encryption, and replayable tokens. The official Wallet is reported to have had a critical vulnerability involving plaintext recovery mnemonics.\"}]","TENET - TELEGRAM MINI APP SECURITY AUDITING | PDF",1791924347]