Songloft 2.9.0 以往版本發現硬編碼管理員憑證漏洞（CVE-2026-119662）
CVE-2026-119662 - Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
Songloft 2.9.0 以往版本存在硬編碼管理員憑證漏洞（CVE-2026-119662），允許同網路內部攻擊者以預設帳號登入並修改設定。
- 受影響版本：2.9.0 以往版本至 2.13.5，建議升級至 2.13.6 或更高。
此漏洞使同網路攻擊者可以預設帳號登入，影響 Songloft 2.9.0 以往版本，建議升級至 2.13.6 以移除硬編碼憑證，並監控網路存取以降低風險。
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.
Impact
Affected Products
The following products are affected by CVE-2026-119662
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 |
Update Songloft to version 2.13.6 or later to address hardcoded credentials.
- Update Songloft to version 2.13.6 or later.
- Remove hardcoded administrative credentials.
- Secure authentication endpoints.
- Monitor network access.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-119662 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.