Description
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| huangxd- | danmu_api | < 1.21.7 | 1.21.7 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- danmu_api - Unauthenticated Access to Admin API via Default Token http/cves/2026/CVE-2026-116485.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- GitHub Issue #531 issue-tracking
- Fix Commit patch
- https://github.com/huangxd-/danmu_api/blob/5ef63a01bae7c4bad4dcd7bafbbcdcf33aa82564/danmu_api/worker.js#L223-L244 technical-description
- https://github.com/huangxd-/danmu_api product
- VulnCheck Advisory: danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints third-party-advisory