CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-119660 — MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows...

·Source: NIST NVD

Updated:

Executive Summary

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.

Analysis

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots. CVSS Score: 9.8. Published: 2026-10-30T15:16:50.197.

Indicators of Compromise (1)

CVE (1)
CVE-2026-119660
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 30, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-119706 — InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code e...

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

CVE-2026-119706
NIST NVD
MEDIUMVulnerability

California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

Los Angeles County officials told CyberScoop they received multiple grand jury subpoenas investigating alleged election fraud. States and civil groups call it a federal power play. The post California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment appeared first on CyberScoop .

CyberScoop
MEDIUMVulnerability

Trezor warns of suspected crypto-theft implant in hardware wallet

Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. [...]

BleepingComputer