CVE-2026-119660: MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key

Published Oct 30, 2026

Updated

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default sessionkey 'musebotsessionkey'. Attackers can sign a MuseBot-session cookie carrying a userid to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade MuseBot to a version that resolves this vulnerability.
Fixed in 2.0.0

Event History

Oct 30, 2026

CVE Published

via MITRE·02:16 PM

Data Sourced

via MITRE·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

MuseBot versions before 2.0.0 are affected. The issue is reachable over the network and requires no authentication or user interaction.

What does an attacker need to exploit this issue?

An attacker needs to create a MuseBot-session cookie signed with the hard-coded default session_key value, 'muse_bot_session_key', and include a user_id. This can produce an administrative session.

What access can a successful attacker obtain?

A successful attacker can gain full administrative access. This includes reading password hashes, chat records, and bot configuration, as well as stopping bots.

CVE-2026-119660: MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What access can a successful attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What access can a successful attacker obtain?