CVE-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default sessionkey 'musebotsessionkey'. Attackers can sign a MuseBot-session cookie carrying a userid to gain full administrative access,...