9.8Critical
CVE-2026-116485danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
Description
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
Weakness (CWE):
CWE-306
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- GitHub Issue #531 issue-tracking
- Fix Commit patch
- https://github.com/huangxd-/danmu_api/blob/5ef63a01bae7c4bad4dcd7bafbbcdcf33aa82564/danmu_api/worker.js#L223-L244 technical-description
- https://github.com/huangxd-/danmu_api product
- VulnCheck Advisory: danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints third-party-advisory