danmu_api: Authentication bypass via default configuration (CVE-2026-116485)

danmu_api versions prior to 1.21.7 are vulnerable to an unauthenticated authentication bypass when the 'ADMIN_TOKEN' environment variable is not explicitly configured, causing the application to fall back to a default token. Attackers can leverage this to send malicious requests to environment modification endpoints, leading to full configuration takeover.

Attack Chain

1. Discovery: Attacker identifies a target running a vulnerable version of danmu_api with default configuration.
2. Access: Attacker interacts with the API using the known default token.
3. Exploitation: Attacker sends POST requests to '/api/env/set', '/api/env/add', or '/api/env/del'.
4. Configuration Modification: Attacker updates 'ADMIN_TOKEN' to take control, or modifies 'OTHER_SERVER' or 'PROXY_URL'.
5. Impact: Attacker executes arbitrary configuration changes, including redeployment or redirecting traffic for Server-Side Request Forgery (SSRF).

Impact

Successful exploitation allows unauthenticated attackers to gain administrative control over the danmu_api instance. This can lead to persistent lockout of legitimate operators, arbitrary server environment modification, and server-side request forgery (SSRF) by manipulating proxy and server URLs.

Recommendation

• Update danmu_api to version 1.21.7 or later immediately.
• If upgrading is not immediately possible, explicitly set the 'ADMIN_TOKEN' environment variable to a strong, unique value to override the vulnerable default.
• Review server environment configuration for unauthorized modifications using the hunt leads provided below.