🟢 [LOW] CB-020: Telegram Bot Token Partially Leaked in Identity #29

New issue

Open

opened 2026-02-20 08:50:05 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:05 +00:00

Security Finding from Audit

Parent issue: #1

Severity

LOW 🟢

CVSS Score

N/A

CWE

CWE-200 (Exposure of Sensitive Information)

Location

telegram/plugin.py, get_identity()

Description

get_identity() returns self._bot_token[:10] + "...".

While truncated, Telegram bot tokens follow the format <bot_id>:<hash>, so the first 10 characters typically reveal the full bot user ID.

Recommendation

Avoid leaking any portion of authentication tokens.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-020

## Security Finding from Audit > Parent issue: #1 ### Severity **LOW** 🟢 ### CVSS Score N/A ### CWE CWE-200 (Exposure of Sensitive Information) ### Location `telegram/plugin.py, get_identity()` --- ### Description `get_identity()` returns `self._bot_token[:10] + "..."`. While truncated, Telegram bot tokens follow the format `<bot_id>:<hash>`, so the first 10 characters typically reveal the full bot user ID. --- ### Recommendation Avoid leaking any portion of authentication tokens. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-020*