CrowdSecLive Exploit Tracker
Insufficient DataCVE-2026-116485Public Exploit

danmu_api - Authentication Bypass (CVE-2026-116485)

PublishedOct 26, 2026
First SeenN/A
Last Seen
Reported
CVSS9.3
H
Huangxd-danmu_api
web_application

Description

danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.

psychologyCrowdSec Analysis

CVE-2026-116485 is a critical authentication bypass vulnerability in danmu_api before version 1.21.7 when the default TOKEN is used and ADMIN_TOKEN is unset. Unauthenticated attackers can modify server environment settings through API endpoints, potentially set an administrator token, lock out operators, redirect server or proxy destinations to enable SSRF, and trigger redeployment.

CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-116485 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts target /api/config to identify instances with hasAdminToken set to false, followed by unauthenticated requests to /api/cache/animes. This behavior can indicate probing for danmu_api instances vulnerable to the default-token authentication bypass.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-10-26
Rule Released2026-10-27

Related Weaknesses

CWE-306: Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References