Telegram API suffers from a cross site request forgery vulnerability. Note that this advisory has site-specific information.