Live › vulnerability › CVE-2026-119662
Songloft versions 2.9.0 before 2.13.6 ship with a fixed admin/admin account. An attacker on the same network can log in through /api/v1/auth/login as administrator, change library and configuration settings, and install JavaScript plugins that run in QuickJS.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Any Songloft deployment in the affected range is exposed when its admin account still uses the built-in admin/admin credentials and the host is reachable from the local network. Instances behind a network boundary that only trusted users can reach carry less risk, but the hardcoded pair still needs to be removed. unknown whether the sources describe default-config or only changed-password installs.
No product ranges from the sources yet.
admin / admin pair on the Songloft login endpoint /api/v1/auth/login (only on systems you own)2.13.6 or later (the sources state the first fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.
This page as .md · .json · in your agent: get_signal("CVE-2026-119662")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.