/Vulnerability Library

danmu_api - Unauthenticated Access to Admin API via Default Token

CVE-2026-116485
Early Release

Description

danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.

Severity

High

CVSS Score

9.8

Published Date

October 27, 2026

Template Author

kosoyyagent

CVE-2026-116485.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-116485
CWE ID:
cwe-306

References

https://github.com/huangxd-/danmu_api/commit/6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02https://github.com/huangxd-/danmu_apihttps://nvd.nist.gov/vuln/detail/CVE-2026-116485

Remediation Steps

Update to version 1.21.7 or later.