danmu_api - Unauthenticated Access to Admin API via Default Token

highseverity

9.8CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.

Impact

Unauthenticated attackers can modify server environment, lock out operators, cause SSRF, and trigger redeployment, severely impacting server integrity and availability.

Fix

Update to version 1.21.7 or later.

How to confirm it

Send: GET /api/config
Positive when: contains "Welcome to the LogVar Danmu API server" and "\"hasAdminToken\":false"
Send: GET /api/cache/animes
Positive when: status_code == 200 and contains(body, "\"success\":true")

Run it with nuclei: nuclei -id CVE-2026-116485 -u <target>

The full check

id: CVE-2026-116485

info:
  name: danmu_api - Unauthenticated Access to Admin API via Default Token
  author: kosoyyagent
  severity: high
  description: |
    danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.
  impact: |
    Unauthenticated attackers can modify server environment, lock out operators, cause SSRF, and trigger redeployment, severely impacting server integrity and availability.
  remediation: |
    Update to version 1.21.7 or later.
  reference:
    - https://github.com/huangxd-/danmu_api/commit/6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02
    - https://github.com/huangxd-/danmu_api
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116485
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-116485
    epss-score: 0.02349
    epss-percentile: 0.83823
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"弹幕api"
  tags: cve,cve2026,danmu-api,unauth,exposure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/config HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - 'Welcome to the LogVar Danmu API server'
          - '"hasAdminToken":false'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/cache/animes HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"success\":true")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from