Live › vulnerability › CVE-2026-119660
MuseBot before 2.0.0 signs its session cookies with a hard-coded default session key, 'muse_bot_session_key'. An unauthenticated attacker can forge a cookie for any user ID and gain full administrative access, including password hashes, chat records and bot configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running MuseBot before 2.0.0 that have not changed the default session key. The sources do not say whether the default key is used in every deployment or only some configurations, so check the session key setting directly. Systems that do not run MuseBot can skip it.
No product ranges from the sources yet.
2.0.0 are affected.session_key setting is still the default value muse_bot_session_key (unknown where it is configured).2.0.0 or later (the sources state the fix is in 2.0.0).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
This page as .md · .json · in your agent: get_signal("CVE-2026-119660")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.