CVE-2020-12474

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-01 · updated 2026-06-17

Description

Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.

Affected products

Telegram: through 6.0.1
Telegram Desktop: through 2.0.1

References

https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474
https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474

Get alerted when CVE-2020-12474 or the next vulnerability affects your stack