{"id":"CVE-2026-119660","published":"2026-10-30T15:16:50.197","lastModified":"2026-10-30T19:23:25.493","description":"MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1394"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yincongcyincong/MuseBot","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/issues/61","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypass","tags":[]},{"url":"https://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key","tags":[]}],"exploitRefs":[{"url":"https://github.com/yincongcyincong/MuseBot","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0cae","tags":[]},{"url":"https://github.com/yincongcyincong/MuseBot/issues/61","tags":[]}],"hasPoc":true,"ai":{"summary":"MuseBot before 2.0.0 uses a hard-coded session key ('muse_bot_session_key') to sign authentication cookies, allowing unauthenticated attackers to forge arbitrary admin sessions by crafting a valid MuseBot-session cookie with any user_id.","exploitability":"Trivial to exploit; requires only knowledge of the default session key and ability to set a signed cookie—no authentication or user interaction needed.","blast_radius":"Full administrative compromise of the bot, including access to sensitive data (password hashes, chat logs, configuration) and the ability to stop bots, affecting all deployments running vulnerable versions.","remediation":"Upgrade to MuseBot 2.0.0 or later, which removes the hard-coded session key and implements secure session management.","detection":"Look for HTTP requests containing a MuseBot-session cookie signed with the known default key 'muse_bot_session_key' (e.g., via cookie value patterns or cryptographic verification failures in logs); also monitor for admin-level API calls originating from sessions with unexpected user_id values.","tags":["auth-bypass","session-hijack","web","hardcoded-secret"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:46:38.525Z"}}