CVE-2026-119662

Published 30 October 2026 · tracked since 31 October 2026

Description

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration setti

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-84172
• CVE-2026-84177
• CVE-2026-84231
• CVE-2026-87718
• CVE-2026-95863
• CVE-2026-82956
• CVE-2026-83539
• CVE-2026-83559
• CVE-2026-83594
• CVE-2026-84170

→ Open the live CVE board · all tools