Threats affecting pkg:github/MuseBot

MuseBot versions prior to 2.0.0 contain a critical authentication bypass vulnerability due to the use of a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing session cookies with the default key, granting full administrative access. Exploitation enables attackers to read sensitive data such as password hashes, chat records, and bot configurations, and to stop bots. The vulnerability is fixed in MuseBot version 2.0.0.