Authentication bypass in danmu_api lets attackers change server settings
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
danmu_api before 1.21.7 contains an authentication bypass, tracked as CWE-306, where a default TOKEN is accepted when ADMIN_TOKEN is unset. An unauthenticated remote attacker can send POST requests to the /api/env/set, /api/env/add or /api/env/del endpoints to change server environment settings, including setting ADMIN_TOKEN, redirecting OTHER_SERVER or PROXY_URL for server-side request forgery, and triggering redeployment.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update danmu_api to version 1.21.7 or later, which is the fixed version listed for this product. CISA has not listed this vulnerability in the Known Exploited Vulnerabilities catalog.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA danmu_api (huangxd-) Fixed in 1.21.7
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116485
- 2026-10-27 Alias added: GHSA-m7f5-h255-c4xv
- 2026-11-02 CISA SSVC decision points changed
References
Sources
- CVE-2026-116485 · CVE Program
- CVE-2026-116485 · NVD
- FIRST EPSS
- GHSA-m7f5-h255-c4xv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences