CVE-2026-116485 in danmu_api
Summary
by MITRE • 10/26/2026
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The danmu_api software version prior to 1.21.7 contains a critical authentication bypass vulnerability that stems from improper handling of default configuration values during the initialization phase. This flaw specifically affects systems where the ADMIN_TOKEN environment variable is left unset or defaults to an empty state, while the application relies on a static default TOKEN for administrative operations. In such configurations, the access control mechanism fails to enforce strict identity verification, allowing unauthenticated actors to interact with sensitive administrative endpoints as if they were legitimate administrators. This represents a fundamental failure in security configuration management and authentication logic, where the absence of explicit credentials does not trigger a denial of service but rather grants unrestricted access due to permissive default settings.
The technical exploitation vector involves sending specific POST requests to internal API endpoints such as /api/env/set, /api/env/add, or /api/env/del. These endpoints are designed for managing server environment variables and configuration parameters. Due to the authentication bypass, an attacker can manipulate these configurations without providing valid credentials. By modifying critical system variables, attackers gain the ability to alter the operational state of the application server significantly. This includes setting a new ADMIN_TOKEN which effectively allows the attacker to establish persistent administrative access or lock out legitimate operators by changing their own token values. The vulnerability is classified under CWE-287 as an Improper Authentication issue, specifically highlighting the failure to verify identity when default credentials are present.
The operational impact of this vulnerability extends beyond simple unauthorized configuration changes. Attackers can redirect critical network parameters such as OTHER_SERVER or PROXY_URL to malicious destinations controlled by them. This capability facilitates Server-Side Request Forgery attacks, where the vulnerable server is coerced into making requests to internal resources that should not be accessible from the outside internet. Through SSRF, attackers may access internal databases, cloud metadata services, or other backend systems within the same network segment. Furthermore, the ability to trigger redeployment operations can lead to service disruption and potential code injection if the deployment process pulls from untrusted sources. This aligns with MITRE ATT&CK techniques related to Command and Control via Proxy Discovery and Defense Evasion through configuration manipulation.
Mitigation strategies must prioritize immediate remediation of default configurations in production environments. Administrators should ensure that ADMIN_TOKEN is always set to a strong, randomly generated value before deploying the application. It is imperative to disable or restrict access to administrative API endpoints unless absolutely necessary, ideally by placing them behind additional layers of authentication such as multi-factor authentication or IP whitelisting for internal networks only. For systems already running versions prior to 1.21.7, upgrading to version 1.21.7 or later is the primary solution, as these updates address the logic flaw in token validation. Additionally, implementing strict input validation and enforcing least-privilege principles on API endpoints can reduce the attack surface even if configuration errors occur. Regular security audits of environment variable management practices are recommended to prevent similar misconfigurations in future deployments.