Musebot
Monthly
Authentication bypass in MuseBot releases before 2.0.0 lets remote unauthenticated attackers forge an administrative session by signing a MuseBot-session cookie with the hard-coded default session_key 'muse_bot_session_key', which ships as the built-in default of the -session_key flag. Any deployment whose admin HTTP interface is network-reachable and which never overrode that default is fully compromised: the forged cookie carries an attacker-chosen user_id and yields administrative access to password hashes, chat records and bot configuration, and allows bots to be stopped. The vendor has released 2.0.0, which auto-generates and persists a random key and actively rejects the legacy default; no CISA KEV entry or public exploit code is confirmed at time of analysis, though a public technical writeup of the bypass exists, so exposure of admin endpoints should be treated as urgent.
Authentication bypass in MuseBot releases before 2.0.0 lets remote unauthenticated attackers forge an administrative session by signing a MuseBot-session cookie with the hard-coded default session_key 'muse_bot_session_key', which ships as the built-in default of the -session_key flag. Any deployment whose admin HTTP interface is network-reachable and which never overrode that default is fully compromised: the forged cookie carries an attacker-chosen user_id and yields administrative access to password hashes, chat records and bot configuration, and allows bots to be stopped. The vendor has released 2.0.0, which auto-generates and persists a random key and actively rejects the legacy default; no CISA KEV entry or public exploit code is confirmed at time of analysis, though a public technical writeup of the bypass exists, so exposure of admin endpoints should be treated as urgent.