# CVE-2026-116485: danmu_api - Authentication Bypass

> Live exploitation tracking for CVE-2026-116485 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-116485

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Huangxd- danmu_api
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** web_application

## Description

danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.

## CrowdSec analysis

[CVE-2026-116485](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-116485) is a critical authentication bypass vulnerability in danmu_api before version 1.21.7 when the default TOKEN is used and ADMIN_TOKEN is unset. Unauthenticated attackers can modify server environment settings through API endpoints, potentially set an administrator token, lock out operators, redirect server or proxy destinations to enable SSRF, and trigger redeployment.

CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-116485 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts target `/api/config` to identify instances with `hasAdminToken` set to false, followed by unauthenticated requests to `/api/cache/animes`. This behavior can indicate probing for danmu_api instances vulnerable to the default-token authentication bypass.

## Timeline

- 2026-10-26: CVE Published. CVE-2026-116485 is published to NVD.
- 2026-10-27: Rule Released. CrowdSec releases a rule to detect CVE-2026-116485 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/huangxd-/danmu_api
- https://github.com/huangxd-/danmu_api/commit/6e93478064a0ce4e7ed3bc2eae88adaad1b7ab02
- https://github.com/huangxd-/danmu_api/blob/5ef63a01bae7c4bad4dcd7bafbbcdcf33aa82564/danmu_api/worker.js#L223-L244
- https://www.vulncheck.com/advisories/danmu-api-before-1.21.7-authentication-bypass-via-default-token-in-env-endpoints
- https://github.com/huangxd-/danmu_api/issues/531
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-116485.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-116485) follows observed exploitation activity for CVE-2026-116485. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.