CVE-2026-119660
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions. Attackers can gain full administrative access, read password hashes, chat records, and bot configuration, and stop bots.
- Affected
- {'products': ['MuseBot'], 'packages': [], 'versions': ['before 2.0.0']}
- Fix
- Upgrade to version 2.0.0 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/yincongcyincong/MuseBot
- https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28
- https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88
- https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681
- https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae
- https://github.com/yincongcyincong/MuseBot/issues/61
- https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass
- https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key
Original description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Last activity 30 Oct 2026. Patch Forecast updates every hour.