Authentication Bypass in MuseBot by Yincong

CVE-2026-119660

What is CVE-2026-119660?

Prior to version 2.0.0, MuseBot is susceptible to an authentication bypass due to the presence of a hard-coded default session key, 'muse_bot_session_key'. This vulnerability allows attackers without proper authentication to forge admin sessions by manipulating a MuseBot-session cookie with an arbitrary user_id. Successful exploitation grants unauthorized users full administrative access, leading to exposure of sensitive data such as password hashes, chat records, and bot configurations, as well as control over bot operations.

References