Hardcoded Credentials Vulnerability in Songloft by Songloft Organization

CVE-2026-119662

What is CVE-2026-119662?

The Songloft product versions prior to 2.13.6 contain a vulnerability where hardcoded credentials permit adjacent network attackers to log in as an administrator. Exploiting this weakness allows unauthorized users to access sensitive library and configuration settings, potentially enabling them to install malicious JavaScript plugins through the /api/v1/auth/login endpoint. This raises significant security concerns as attackers can manipulate the application’s functionality and data.

References