Danmu_api (< 1.21.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/danmu_api--1.21.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 17:03:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgdanmu_api: Authentication bypass via default configuration (CVE-2026-116485)https://feed.craftedsignal.io/briefs/2026-10-danmu-api-auth-bypass/Mon, 26 Oct 2026 17:03:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-danmu-api-auth-bypass/An authentication bypass vulnerability in danmu_api before 1.21.7 allows unauthenticated attackers to modify server environment configurations and facilitate SSRF through crafted POST requests to environment management endpoints.danmu_api versions prior to 1.21.7 are vulnerable to an unauthenticated authentication bypass when the 'ADMIN_TOKEN' environment variable is not explicitly configured, causing the application to fall back to a default token. Attackers can leverage this to send malicious requests to environment modification endpoints, leading to full configuration takeover.

Attack Chain

  1. Discovery: Attacker identifies a target running a vulnerable version of danmu_api with default configuration.
  2. Access: Attacker interacts with the API using the known default token.
  3. Exploitation: Attacker sends POST requests to '/api/env/set', '/api/env/add', or '/api/env/del'.
  4. Configuration Modification: Attacker updates 'ADMIN_TOKEN' to take control, or modifies 'OTHER_SERVER' or 'PROXY_URL'.
  5. Impact: Attacker executes arbitrary configuration changes, including redeployment or redirecting traffic for Server-Side Request Forgery (SSRF).

Impact

Successful exploitation allows unauthenticated attackers to gain administrative control over the danmu_api instance. This can lead to persistent lockout of legitimate operators, arbitrary server environment modification, and server-side request forgery (SSRF) by manipulating proxy and server URLs.

Recommendation

  • Update danmu_api to version 1.21.7 or later immediately.
  • If upgrading is not immediately possible, explicitly set the 'ADMIN_TOKEN' environment variable to a strong, unique value to override the vulnerable default.
  • Review server environment configuration for unauthorized modifications using the hunt leads provided below.
]]>criticaladvisoryweb-vulnerabilityauthentication-bypassssrf