{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/danmu_api--1.21.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-116485"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["danmu_api (\u003c 1.21.7)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","authentication-bypass","ssrf"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003edanmu_api versions prior to 1.21.7 are vulnerable to an unauthenticated authentication bypass when the 'ADMIN_TOKEN' environment variable is not explicitly configured, causing the application to fall back to a default token. Attackers can leverage this to send malicious requests to environment modification endpoints, leading to full configuration takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eDiscovery: Attacker identifies a target running a vulnerable version of danmu_api with default configuration.\u003c/li\u003e\n\u003cli\u003eAccess: Attacker interacts with the API using the known default token.\u003c/li\u003e\n\u003cli\u003eExploitation: Attacker sends POST requests to '/api/env/set', '/api/env/add', or '/api/env/del'.\u003c/li\u003e\n\u003cli\u003eConfiguration Modification: Attacker updates 'ADMIN_TOKEN' to take control, or modifies 'OTHER_SERVER' or 'PROXY_URL'.\u003c/li\u003e\n\u003cli\u003eImpact: Attacker executes arbitrary configuration changes, including redeployment or redirecting traffic for Server-Side Request Forgery (SSRF).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain administrative control over the danmu_api instance. This can lead to persistent lockout of legitimate operators, arbitrary server environment modification, and server-side request forgery (SSRF) by manipulating proxy and server URLs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate danmu_api to version 1.21.7 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, explicitly set the 'ADMIN_TOKEN' environment variable to a strong, unique value to override the vulnerable default.\u003c/li\u003e\n\u003cli\u003eReview server environment configuration for unauthorized modifications using the hunt leads provided below.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T17:03:25Z","date_published":"2026-10-26T17:03:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-danmu-api-auth-bypass/","summary":"An authentication bypass vulnerability in danmu_api before 1.21.7 allows unauthenticated attackers to modify server environment configurations and facilitate SSRF through crafted POST requests to environment management endpoints.","title":"danmu_api: Authentication bypass via default configuration (CVE-2026-116485)","url":"https://feed.craftedsignal.io/briefs/2026-10-danmu-api-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Danmu_api (\u003c 1.21.7)","version":"https://jsonfeed.org/version/1.1"}