Summary
generated automatically from NVD dataMuseBot versions before 2.0.0 ship with a hard-coded default session_key, 'muse_bot_session_key', which is used to sign session cookies. An unauthenticated attacker can sign a MuseBot-session cookie containing a user_id and so forge an administrator session. This grants full administrative access, including reading password hashes, chat records and bot configuration, and stopping bots. The flaw is rated CVSS 9.8 (CRITICAL) under CVSS v3.1 and is classified as CWE-1394.
NVD description
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
EPSS · FIRST.org
0.52%probability of exploitation in the next 30 days
Higher than 44% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-31, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 30 oct. 2026
- Updated
- 30 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (8)
Similar CVEs
Other vulnerabilities of type CWE-1394
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.