CVE-2026-119660: Hard-Coded Session Key Lets Attackers Take Over MuseBot Admin

"MuseBot before version 2.0.0 ships with a hard-coded default session key, so an unauthenticated attacker can forge an admin session and take full administrative control."

MuseBot before version 2.0.0 ships with a hard-coded default session key, so an unauthenticated attacker can forge an admin session and take full administrative control.

What Is It

CVE-2026-119660 is an authentication bypass in MuseBot, an open-source project maintained by yincongcyincong on GitHub. Versions before 2.0.0 use the hard-coded default session_key value muse_bot_session_key. Anyone who knows that key can sign their own MuseBot-session cookie containing a chosen user_id, and the admin interface will accept the forged session as real.

The weakness is classified as CWE-1394. VulnCheck disclosed the issue, and NVD published it on 2026-10-30. Its NVD status is currently "Deferred."

Why It Matters

VulnCheck rates this CRITICAL: CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 base score 9.3. The attack works over the network, is low complexity, and needs no credentials or user interaction.

An attacker who forges a session gets full administrative access. According to the advisory, that lets them:

Read stored password hashes
Read chat records
Read bot configuration
Stop running bots

That means confidentiality, integrity and availability are all at risk. Any MuseBot admin panel reachable from untrusted networks should be treated as exposed.

Exploitation status: This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. A public technical write-up of the bypass is available (see Sources).

What's Vulnerable

Vendor: yincongcyincong
Product: MuseBot
Affected versions: All versions before 2.0.0 (semver)
Repository: https://github.com/yincongcyincong/MuseBot

The NVD references point to the hard-coded key in admin/conf/conf.go and the login handling in admin/controller/login.go, both at tag v1.0.42.

Patch Status

The affected range ends below 2.0.0, which means version 2.0.0 is the first version not listed as affected. The NVD record references two upstream commits linked to the fix. Upgrade MuseBot to 2.0.0 or later. CISA has no KEV entry for this CVE, so there is no federal required action or due date.