CVE-2026-119660

Summary

MuseBot before 2.0.0 uses a hard-coded session key ('muse_bot_session_key') to sign authentication cookies, allowing unauthenticated attackers to forge arbitrary admin sessions by crafting a valid MuseBot-session cookie with any user_id.

Exploitability

Trivial to exploit; requires only knowledge of the default session key and ability to set a signed cookie—no authentication or user interaction needed.

Blast radius

Full administrative compromise of the bot, including access to sensitive data (password hashes, chat logs, configuration) and the ability to stop bots, affecting all deployments running vulnerable versions.

Detection

Look for HTTP requests containing a MuseBot-session cookie signed with the known default key 'muse_bot_session_key' (e.g., via cookie value patterns or cryptographic verification failures in logs); also monitor for admin-level API calls originating from sessions with unexpected user_id values.

Prioritized remediation

Upgrade to MuseBot 2.0.0 or later, which removes the hard-coded session key and implements secure session management.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.