CVE-2026-119662 in Songloft
Summary
by MITRE • 10/30/2026
Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration settings and install JavaScript plugins running in QuickJS.
If you want to get best quality of vulnerability data, you may have to visit VulDB.