CVE-2026-119660: falha crítica em yincongcyincong MuseBot
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.5%
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
yincongcyincong · MuseBotReferências
https://github.com/yincongcyincong/MuseBothttps://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/conf/conf.go#L28https://github.com/yincongcyincong/MuseBot/blob/v1.0.42/admin/controller/login.go#L19-L88https://github.com/yincongcyincong/MuseBot/commit/139f6158b50283b983d76976f593a3a09a064681https://github.com/yincongcyincong/MuseBot/commit/3e64518948fe7037058f07ef987d35216c3f0caehttps://github.com/yincongcyincong/MuseBot/issues/61https://hackmd.io/@hieuPenguinnn/musebot-admin-default-session-key-auth-bypasshttps://www.vulncheck.com/advisories/musebot-before-2.0.0-authentication-bypass-via-hard-coded-session-key