MuseBot 2.0.0 以上版本修補硬編碼會話金鑰認證繞過漏洞
CVE-2026-119660 - MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
MuseBot 2.0.0 之前的版本存在一個認證繞過漏洞，攻擊者可使用硬編碼的會話金鑰冒充管理員。
- 漏洞影響：可冒充管理員、讀取密碼雜湊、聊天紀錄、機器人設定，甚至停止機器人。
此漏洞可讓未授權使用者冒充管理員，讀取密碼雜湊與聊天紀錄，提示使用者即時升級至 MuseBot 2.0.0 或更高版本以修補。
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Impact
Affected Products
The following products are affected by CVE-2026-119660
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE | ||||
| CVSS 4.0 | CRITICAL | 83251b91-4cc7-4094-a5c7-464a1b83ea10 |
Update MuseBot to resolve authentication bypass via hard-coded session key.
- Update MuseBot to version 2.0.0 or later.
- Change the default session_key immediately.
- Invalidate all existing sessions.
- Restart the application.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-119660 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.