MuseBot Authentication Bypass Lets Attackers Forge Admin Sessions

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'.

Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access.

This can lead to:

• Reading password hashes
• Reading chat records
• Reading bot configuration
• Stopping bots