CVE-2026-119660 Details
Description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
A vulnerability allowing authentication bypass has been identified in MuseBot versions prior to 2.0.0. This issue arises from a hard-coded default session key, 'muse_bot_session_key', which enables unauthenticated attackers to forge admin session cookies. The vulnerability allows attackers to gain full administrative access, including the ability to read password hashes, chat records, and bot configurations, as well as to stop bot processes.
Update MuseBot to version 2.0.0 or later, and ensure that the 'session_key' is set to a strong, random value. After updating, log into the admin panel to create a new admin account.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1394 | Use of Default Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MuseBot | >= 0, < 2.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |