An audit carried out by Symbolic Software and obtained by Important Stories found that Telegram clients transmit messages in such a way that an identifier called "auth_key_id" appears in plaintext or in a form that is easy to deobfuscate. This identifier remains unchanged across sessions, when the IP address changes, when switching networks, and when the geographic location changes.
This means that an internet service provider, a network administrator, a state surveillance system, or any other entity with passive access to Telegram traffic can collect such identifiers without breaking encryption, intercepting certificates, or actively interfering with the connection.
According to experts, such access would allow an observer to build a database linking specific devices to network locations, timestamps, and traffic patterns. If a user's identity is known from other sources, the same data can be used to track the device over time.
Background: The 2025 Investigation
In 2025, an investigation by OCCRP and IStories revealed that Russian network engineer Vladimir Vedeneyev served as Telegram's chief financial officer, held power of attorney to sign documents on behalf of Telegram and its founder Pavel Durov, and managed companies linked to Russian state and security agencies, including the FSB. Vedeneyev himself acknowledged having a handler from the FSB and responding to requests from security services concerning Russian internet users. Vedeneyev denied the existence of the vulnerability described by journalists and stated that he does not pass Telegram data to the FSB.
Telegram's Position
Telegram rejected the latest findings. In a response to Important Stories, the company stated that the "auth_key_id" parameter changes regularly and does not disclose information about users, message content, recipients, or personal data. Telegram also said that its infrastructure is managed exclusively by internal engineering teams and denied any connection between Vedeneyev or his company GNM and the FSB.
2
