I'm not sure you know what "critical" means—this bug definitely isn't it—but you should probably report it to Telegram instead of posting on HN. You claim you couldn't find a way to do that, but they have a security@ address [1], so you can't have looked very carefully.

[1] https://telegram.org/faq#q-what-if-my-hacker-friend-says-the...