EUVD-2026-109812
GHSA-m7f5-h255-c4xv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed danmu_api instance
-
DeliveryPOST to /api/env/set|add|del
-
ExploitBypass auth via default TOKEN, ADMIN_TOKEN unset
-
ExecutionSet ADMIN_TOKEN and redirect PROXY_URL/OTHER_SERVER
-
ImpactTrigger redeployment, lock out operator, pivot via SSRF
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two specific conditions stated in the description: the deployment must still be running the default TOKEN (87654321) AND the ADMIN_TOKEN environment variable must be unset. Under that state the system-management endpoints /api/env/set, /api/env/add, and /api/env/del inherit the token-free default-TOKEN compatibility path and accept unauthenticated POST requests over the network. The limiting factor is precisely this configuration: per the fixing commit and README, version 1.21.7 forces ADMIN_TOKEN on these endpoints (returning 401 when unset and disabling the default-TOKEN bypass for them), so any instance that has set a non-default TOKEN or configured ADMIN_TOKEN is not exploitable. Upgraded deployments that previously had no ADMIN_TOKEN must set one before the management interface works again. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and CWE-306 (missing authentication) matches the description: when the default TOKEN (87654321) is in use and ADMIN_TOKEN is unset, the management endpoints inherit the token-free compatibility path and are reachable without credentials. The vuln.today decision label is act_now and the report originates from VulnCheck, reinforcing urgency. No EPSS score and no KEV listing were provided in the input, so there is no quantitative exploitation-probability signal and no evidence of active in-the-wild exploitation - the priority here rests on ease of exploitation and impact (config takeover, operator lockout, SSRF, forced redeployment) rather than on observed attacks. The references include the GitHub issue, the fixing commit, the vulnerable source lines, and the VulnCheck advisory, but none is labeled as confirmed working exploit code, so public-exploit availability is unconfirmed. The one real caveat is the precondition: exploitation only works while the deployment still runs the default TOKEN with ADMIN_TOKEN unset - a common default state but one that operators may already have changed. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed danmu_api instance still running the default TOKEN=87654321 with ADMIN_TOKEN unset, then sends an unauthenticated POST to /api/env/set. In a single request they set ADMIN_TOKEN to a value only they know (locking out the legitimate operator) and repoint PROXY_URL or OTHER_SERVER to an internal target for SSRF, then trigger a redeployment to apply the hijacked configuration. Given AV:N/AC:L and no authentication, this requires only HTTP reachability; no public working exploit is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Unauthenticated remote attackers can rewrite server environment configuration in danmu_api deployments running a version before 1.21.7 when two conditions coincide: the install still uses the shipped default TOKEN of 87654321 and the ADMIN_TOKEN environment variable is unset. In that state the system-management endpoints /api/env/set, /api/env/add and /api/env/del inherit the token-free default-TOKEN compatibility path and accept unauthenticated POST requests, letting an attacker write ADMIN_TOKEN to seize the management interface, lock out the operator, or repoint OTHER_SERVER and PROXY_URL to internal targets for SSRF and forced redeployment. The vendor addressed this in 1.21.7 by requiring ADMIN_TOKEN on those endpoints (401 when unset) and excluding them from the default-TOKEN bypass; no public exploit code was identified at time of analysis, and instances that already use a non-default TOKEN or have set ADMIN_TOKEN are not exposed.
RemediationAI
Upgrade to danmu_api 1.21.7 or later, which contains commit 6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02 and forces a server-side ADMIN_TOKEN check on /api/env/set, /api/env/add, /api/env/del and the other management routes (deploy, cache, logs, cookie, verify), returning 401 when ADMIN_TOKEN is unset. Because the upgrade closes the default-TOKEN compatibility path for those routes, operators who previously ran without ADMIN_TOKEN must set one after upgrading before the management interface becomes usable again - plan for that step to avoid locking yourself out of administration. For instances that cannot be upgraded immediately, the exposure is configuration-dependent: set ADMIN_TOKEN to a strong secret and change TOKEN from the shipped default 87654321, after which the described attacks are no longer possible; as a compensating control, restrict network access to the /api/env/* and /api/deploy management paths at the reverse proxy or ingress, accepting that this also blocks legitimate administrative use of those endpoints from untrusted networks. Review existing environment configuration for unexpected ADMIN_TOKEN, OTHER_SERVER or PROXY_URL values before patching on any instance that may have been reachable with the defaults set.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
danmu_api is a JavaScript/Node service (deployed also as a Cloudflare Worker, with request handling in danmu_api/worker.js and environment defaults in danmu_api/configs/envs.js) that serves danmaku comment data for video sources and exposes administrative endpoints for changing runtime environment variables. The flaw is CWE-306, missing authentication for a critical function: the default-token compatibility path keyed on the shipped TOKEN value 87654321 was intended for the public data API but was also reachable from the system-management handlers, so the /api/env/set, /api/env/add and /api/env/del routes performed privileged configuration writes without an independent authorization check. Because those handlers persist arbitrary environment keys, an attacker can define ADMIN_TOKEN themselves, remove or overwrite operator credentials to lock out administration, or rewrite OTHER_SERVER and PROXY_URL so subsequent upstream fetches are directed at attacker- or internally-chosen hosts, which is the SSRF vector, and can additionally force a redeployment cycle. The fixing commit 6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02 enforces a server-side ADMIN_TOKEN requirement for env/deploy/cache/logs/cookie/verify management routes and documents that the default TOKEN compatibility no longer applies to them; the vulnerability class requires no authentication or user interaction (PR:N/UI:N in the assessed vector), but exploitation is conditional on the deployment retaining the default TOKEN and leaving ADMIN_TOKEN unset.
Know when Danmu Api gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Default TOKEN with unset ADMIN_TOKEN is the shipped default state so AC:L/PR:N; network endpoints yield config modification (I:H), SSRF exposure (C:H), and operator lockout/redeploy (A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
Latest POC
1 public PoC link from nuclei
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
CVE-2026-116485 (CVSS 9.3) is a critical authentication bypass in danmu_api versions before 1.21.7 that allows unauthenticated attackers to take over server management and reconfigure internal services. Organizations using the product with default credentials and no ADMIN_TOKEN are exposed to full compromise, leading to potential data breaches, service disruption, and internal network intrusion. Leadership should prioritize immediate patching because the flaw is trivial to exploit and can be used to pivot into sensitive systems.
Apply vendor patch (version 1.21.7 or later). If unable to patch immediately, set a strong non-default TOKEN and explicitly define ADMIN_TOKEN in the environment to disable the vulnerable compatibility path.
Threat Model
5 threats: Elevation of Privilege, Tampering, Denial of Service and 2 more
4-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB