CVE-2026-76131: Use of hard-coded credentials in Yamaha Corporation VOCALOID6

The vulnerability CVE-2026-76131 in VOCALOID6 arises from the use of hard-coded credentials within the software. This security weakness may enable an attacker to impersonate a legitimate VOCALOID6 Editor, thereby gaining unauthorized access to Yamaha's activation and content servers. The affected versions include all releases from 0 through 6.13.0. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

An attacker exploiting this vulnerability could impersonate a legitimate VOCALOID6 Editor and gain unauthorized access to Yamaha's activation and content servers. This could potentially lead to unauthorized use or distribution of licensed content. The confidentiality impact is limited, and there is no impact on integrity or availability as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Yamaha's advisories for updates. Until a fix is available, restricting network access to activation and content servers and limiting use of affected VOCALOID6 versions may reduce risk.