PT-2026-133590

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session key 'muse bot session key'. Attackers can sign a MuseBot-session cookie carrying a user id to gain full administrative access,...