CVE-2026-119660 MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
CriticalCVSS 9.3
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yincongcyincong MuseBot | < 2.0.0 | 2.0.0 |
References
- github.com issue-tracking
- github.com patch
- github.com patch
- github.com technical-description
- github.com technical-description
- hackmd.io exploit third-party-advisory
- github.com product
- VulnCheck Advisory: MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key third-party-advisory