CVE-2026-119662: Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
Published Oct 30, 2026
·Updated
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Songloftto a version that resolves this vulnerability.Fixed in 2.13.6
Event History
Oct 30, 2026
CVE Published
via MITRE·02:16 PM
Data Sourced
via MITRE·02:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness