CVE-2026-119662

Versions of Songloft from 2.9.0 before 2.13.6 are vulnerable to a hardcoded credentials vulnerability in the embedded backend. Attackers located on the same network can authenticate as an administrator by using the fixed admin/admin pair via the /api/v1/auth/login endpoint. Successful authenticat...