MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
MuseBot versions before 2.0.0 are in scope, with the issue reported against v1.0.42. CVSS scores it 9.3 critical. Fixed in 2.0.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 2.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
MuseBot, a chatbot application, is affected by an authentication bypass flaw caused by a hard-coded default session key. Unauthenticated attackers can forge administrative sessions, giving them full control to read password hashes, chat records, and bot configurations, and to stop bots.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- yincongcyincong MuseBot
fixed in 2.0.0
References 8
GitHub · yincongcyincong/MuseBot
Questions about CVE-2026-119660
What does this mean?
MuseBot uses a session key that is hard-coded into the software, so the authentication check can be bypassed. The key is not unique to each installation.Source: github.com
Am I affected, and how do I check?
The affected range is MuseBot from the first release up to but not including 2.0.0. The report cites version v1.0.42, so check the installed MuseBot version against that range.Source: github.com
What should I do about it?
Upgrade MuseBot to version 2.0.0 or later, which is the listed fixed version.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data