{"id":"CVE-2026-119660","kind":"vulnerability","aliases":["CVE-2026-119660"],"related":[],"title":"MuseBot: hard-coded session key lets attackers forge admin sessions","description":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.","summary":"MuseBot before 2.0.0 signs its session cookies with a hard-coded default session key, 'muse_bot_session_key'. An unauthenticated attacker can forge a cookie for any user ID and gain full administrative access, including password hashes, chat records and bot configuration.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["musebot","other","self-hosted"],"not_affected_if":["custom-session-key","version-2.0.0-or-later"],"how_to_check":"- Check the MuseBot version in use; versions before `2.0.0` are affected.\n- Check whether the `session_key` setting is still the default value `muse_bot_session_key` (unknown where it is configured).","fix":"- Move to MuseBot `2.0.0` or later (the sources state the fix is in `2.0.0`).","status":"open","published_at":"2026-10-30T15:16:50+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:32:59+00:00","updated_at":"2026-10-30T15:32:59+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T15:32:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move to MuseBot `2.0.0` or later (the sources state the fix is in `2.0.0`).","reach":"internet","title":"MuseBot: hard-coded session key lets attackers forge admin sessions","impact":"high","summary":"MuseBot before 2.0.0 signs its session cookies with a hard-coded default session key, 'muse_bot_session_key'. An unauthenticated attacker can forge a cookie for any user ID and gain full administrative access, including password hashes, chat records and bot configuration.","audience":"businesses","category":"other","nicknames":[],"who_cares":["musebot","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gets full admin access, reads password hashes and chats","analyst_note":"Confirm whether the default session key is used in all deployments and which settings file controls it; check the NVD entry for detail.","how_to_check":"- Check the MuseBot version in use; versions before `2.0.0` are affected.\n- Check whether the `session_key` setting is still the default value `muse_bot_session_key` (unknown where it is configured).","plain_action":"","needs_analyst":true,"not_affected_if":["version-2.0.0-or-later","custom-session-key"],"who_is_affected":"Teams running MuseBot before 2.0.0 that have not changed the default session key. The sources do not say whether the default key is used in every deployment or only some configurations, so check the session key setting directly. Systems that do not run MuseBot can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000699,"input_tokens":4162,"output_tokens":565,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119660':14A,17A '-2026':13A,16A '2.0.0':25B,68C 'access':57B,111C 'admin':10A,80C 'administr':56B,110C 'allow':75C 'attack':8A,44B,77C,95C 'authent':71C 'bot':39B,64B,92C,118C,122C 'bypass':72C 'carri':103C 'chat':61B,115C 'code':4A,34B,87C 'configur':65B,119C 'contain':69C 'cooki':29B,48B,102C 'cve':12A,15A 'default':35B,88C 'forg':9A,46B,79C 'full':55B,109C 'gain':54B,108C 'hard':3A,33B,86C 'hard-cod':2A,32B,85C 'hash':60B,114C 'host':22B 'id':52B,106C 'includ':58B 'key':6A,37B,41B,90C,94C 'let':7A 'muse':38B,91C 'musebot':1A,18B,23B,66C,100C 'musebot-sess':99C 'password':59B,113C 'read':112C 'record':62B,116C 'self':21B 'self-host':20B 'session':5A,11A,28B,36B,40B,81C,89C,93C,101C 'sign':26B,97C 'stop':121C 'unauthent':43B,76C 'use':83C 'user':51B,105C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Teams running MuseBot before 2.0.0 that have not changed the default session key. The sources do not say whether the default key is used in every deployment or only some configurations, so check the session key setting directly. Systems that do not run MuseBot can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119660","severity":null,"published_at":"2026-10-30T15:16:50+00:00","modified_at":"2026-10-30T15:16:50+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}