Zero Radar
← feed
CriticalVulnerabilityCVE-2026-119660updated 30 Oct 2026, 15:18 UTC

MuseBot admin login can be forged with a built-in default key

Anyone who knows a secret password that ships with MuseBot can fake a login as the administrator, without needing a password. From there they can read private data and shut down the bots.

Fix available · out Official source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesUpgrade to MuseBot 2.0.0 or later. · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker finds default keyKey 'muse_bot_session_key' is public
  2. 2Forges session cookieSigns cookie with the known key
  3. 3MuseBot accepts cookieTrusts the forged user_id
  4. 4Admin access gainedReads hashes, chats, configuration
  5. ResultAttacker takes over as administrator

What happened

MuseBot versions before 2.0.0 use the hard-coded default session key 'muse_bot_session_key'. Because this key is publicly known, an unauthenticated attacker can sign a forged session cookie containing a chosen user_id and gain administrator access.

Why it is dangerous: An attacker gets full admin rights, can read password hashes, chat records and bot configuration, and can stop bots. Any MuseBot deployment still using the default key is at risk.

Are you affected?

You are affected if you run MuseBot before version 2.0.0 and have not changed the default session_key.

MuseBot versions before 2.0.0 using the default session_key 'muse_bot_session_key'.

What to do

  1. Upgrade MuseBot to version 2.0.0 or later
  2. Check that session_key is no longer 'muse_bot_session_key' and set a long random value
  3. Review admin accounts and chat and configuration logs for unexpected access
  4. Rotate passwords and any secrets stored by MuseBot if the default key was in use

Timeline

  1. 30 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 15:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119660
CVSS
9.3 / 10
Disclosed
30 Oct 2026, 15:16 UTC
On Zero Radar
30 Oct 2026, 15:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 15:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MuseBot admin login can be forged with a built-in default key · Zero Radar