{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/misaka/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:misaka:danmu_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111643"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Danmu Server (\u003c= 2.8.9)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","web-application-vulnerability","misaka"],"_cs_type":"advisory","_cs_vendors":["Misaka"],"content_html":"\u003cp\u003eMisaka Danmu Server versions 2.8.9 and earlier are affected by a critical authentication bypass vulnerability (CVE-2026-111643) originating in the /api/ui/config-history/rollback endpoint. This endpoint lacks proper authentication checks, allowing unauthenticated remote attackers to perform unauthorized configuration modifications. By sending a crafted POST request to this endpoint, an attacker can overwrite sensitive configuration keys such as 'ipWhitelist', 'trustedProxies', and 'webhookApiKey'. Successfully altering these keys permits the attacker to bypass access controls, effectively granting them administrative control over all protected API endpoints. Given the CVSS 3.1 base score of 9.8, this vulnerability poses a severe risk to service integrity and confidentiality.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain full administrative access to the Danmu Server installation. This impact enables attackers to exfiltrate sensitive data, manipulate system operations, or gain persistent access by modifying webhook configurations or trusted proxy settings, potentially leading to total system compromise in affected environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Misaka Danmu Server to a version beyond 2.8.9 to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit logs for unauthorized POST requests directed at the /api/ui/config-history/rollback endpoint.\u003c/li\u003e\n\u003cli\u003eMonitor changes to the 'ipWhitelist', 'trustedProxies', and 'webhookApiKey' configuration values within the application logs for any suspicious modifications.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:44:53Z","date_published":"2026-10-16T18:44:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-misaka-danmu-auth-bypass/","summary":"Misaka Danmu Server versions 2.8.9 and earlier contain an authentication bypass vulnerability allowing unauthenticated attackers to modify sensitive configuration keys via the /api/ui/config-history/rollback endpoint.","title":"Authentication Bypass in Misaka Danmu Server","url":"https://feed.craftedsignal.io/briefs/2026-10-misaka-danmu-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Misaka","version":"https://jsonfeed.org/version/1.1"}