CVE-2026-119660

Name of the Vulnerable Software and Affected Versions MuseBot versions prior to 2.0.0

Description An authentication bypass exists that allows unauthenticated attackers to forge administrative sessions. This is possible due to the use of a hard-coded default session key muse bot session key. By signing a MuseBot-session cookie containing a user id, an attacker can obtain full administrative access to read password hashes, chat records, and bot configurations, as well as stop bots.

Recommendations Update to version 2.0.0.