SZB-36e2bb7a4e
EUVD-2026-114076 reports authentication bypass in MuseBot before 2.0.0
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- yincongcyincong
- Product
- MuseBot
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114076 describes an authentication bypass in MuseBot before 2.0.0, scored 9.3/10 (CVSS v3.1). Per the listing, unauthenticated attackers can forge admin sessions using a hard-coded default session key.
If you use yincongcyincong
Upgrade MuseBot to version 2.0.0 or later immediately
Change the session_key setting from the hard-coded default
Review admin sessions and logs for signs of forged access
What the sources say 1
· Mastodon: “MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'.” Source