NVD security advisoryCritical
Critical advisory for MuseBot
CVE-2026-119660 · Reported 30 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
MuseBotAffected product
Advisory overview
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Related references
- https://github.com/yincongcyincong/MuseBot
- https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28
- https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88
- https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681
- https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae
- https://github.com/yincongcyincong/MuseBot/issues/61
- https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass
- https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key