CVE-2026-119660 MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default sessionkey 'musebotsessionkey'. Attackers can sign a MuseBot-session cookie carrying a userid to gain full administrative access,...

CVE-2026-119660

MuseBot versions prior to 2.0.0 are vulnerable to an authentication bypass caused by a hard-coded default session_key (muse_bot_session_key). This flaw allows unauthenticated attackers to forge valid MuseBot-session cookies by signing them with the known key and a specific user_id. Successful exp...