CVE-2026-116485: danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

Q: Which deployments are exposed?

danmu_api versions before 1.21.7 are exposed when the default TOKEN is in use and ADMIN_TOKEN is unset. The attack can be performed remotely without authentication or user interaction.

Q: What can an attacker do through the affected endpoints?

An attacker can send POST requests to /api/env/set, /api/env/add, or /api/env/del to modify server environment configuration. This includes setting ADMIN_TOKEN to lock out operators, changing OTHER_SERVER or PROXY_URL for SSRF, and triggering redeployment.

Q: What should be done if an immediate upgrade is not possible?

Replace the default TOKEN and set ADMIN_TOKEN, since the described bypass requires the default TOKEN together with an unset ADMIN_TOKEN. Upgrade to version 1.21.7 or later when possible.

Published Oct 26, 2026

Updated

danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMINTOKEN, lock out operators, redirect OTHERSERVER or PROXYURL for SSRF, and trigger redeployment.

Affected Software

1 affected component

pypi/danmu_api<1.21.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade danmu_api to a version that resolves this vulnerability.
Fixed in 1.21.7

Event History

Oct 26, 2026

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

danmu_api versions before 1.21.7 are exposed when the default TOKEN is in use and ADMIN_TOKEN is unset. The attack can be performed remotely without authentication or user interaction.

What can an attacker do through the affected endpoints?

An attacker can send POST requests to /api/env/set, /api/env/add, or /api/env/del to modify server environment configuration. This includes setting ADMIN_TOKEN to lock out operators, changing OTHER_SERVER or PROXY_URL for SSRF, and triggering redeployment.

What should be done if an immediate upgrade is not possible?

Replace the default TOKEN and set ADMIN_TOKEN, since the described bypass requires the default TOKEN together with an unset ADMIN_TOKEN. Upgrade to version 1.21.7 or later when possible.

CVE-2026-116485: danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What can an attacker do through the affected endpoints?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What can an attacker do through the affected endpoints?

What should be done if an immediate upgrade is not possible?