lol. lmao.
https://nvd.nist.gov/vuln/detail/cve-2026-119660
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.
:rainbowCrow:
npub1z3…cp45m
2026-10-30 16:34:33 UTC
Author Public Key
npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45mSeen on
wss://relay.ditto.pubPublished at
2026-10-30 16:34:33 UTCEvent JSON
{
"id": "d0d3237fd69596fe7534fe3b18a3c6036ffa2f3a8285400dc97403f6037bfea5",
"pubkey": "14609e2d429cc6b47de05d41a9840716e4d2e0bec59e8bbf79ad79dd7c5def64",
"created_at": 1793378073,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117530825446447813",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "lol. lmao.\n\nhttps://nvd.nist.gov/vuln/detail/cve-2026-119660\n\nMuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots.",
"sig": "9217e96e8ea2ae4b0fb9cc82d8a7287c943eadbd67fdd92721cdf4c8be4ec6d9a13c4fe4bea1b563226513da6a44130dd93f0a2c6eb3f9e4232523cfcd086417"
}