{"id":"CVE-2026-119660","published":"2026-10-30T15:16:50Z","modified":"2026-10-30T19:23:25Z","title":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…","vendor":"yincongcyincong","product":"MuseBot","tier":"core","eol":null,"description":{"text":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.","provenance":"source","from":"NVD"},"summary":null,"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.0052,"percentile":0.44179,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-1394","name":"Use of Default Cryptographic Key"}],"references":[{"url":"https://github.com/yincongcyincong/MuseBot","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/issues/61","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass","tags":[]},{"url":"https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-114076","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-114076","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-30","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119660","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":15.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":8.84,"detail":"percentile 0.4418"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}