CVE-2026-119660 MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119660?
CVE-2026-119660 is a critical vulnerability in yincongcyincong MuseBot, published on 30 Oct 2026.
Official description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Weakness: CWE-1394
Which versions are affected by CVE-2026-119660?
How do I fix CVE-2026-119660?
No fix has been published for CVE-2026-119660 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119660 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119660 exists.
Sources
Also known as GHSA-77p8-2qmx-794p.