CVE-2026-119662

    Dashboard / Vulnerabilities / CVE-2026-119662

    CVE-2026-119662

    Published: 30 Oct 2026Last Modified: 1 Nov 2026

    Summary: Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

    Details: Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119662.json, https://hackmd.io/@hieuPenguinnn/songloft-default-admin-credentials-unauth-admin-takeover, https://nvd.nist.gov/vuln/detail/CVE-2026-119662, https://www.vulncheck.com/advisories/songloft-2.9.0-before-2.13.6-hardcoded-admin-credentials-in-embedded-backend, https://github.com/songloft-org/songloft/issues/534, https://github.com/songloft-org/songloft/commit/034fc1c442af5d6bc188642f1fb766af648e014d, https://github.com/songloft-org/songloft, https://github.com/songloft-org/songloft/blob/v2.13.3/internal/config/types.go#L15-L22, https://github.com/songloft-org/songloft/blob/v2.13.3/mobile/mobile.go#L60-L84

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ae000d59e79af4ac708aeca1708e3c75afcd69cf
    Fixed -bd5ce4e0334d3805a25f0ff6ac8901cac598b51b

    Affected versions

    v2.13.5
    v2.13.4
    v2.13.3
    v2.13.2
    v2.13.1
    v2.13.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119662 | CVE-DB