CVE-2026-116485 is a critical authentication bypass in danmu_api before version 1.21.7: on deployments still using the default TOKEN with ADMIN_TOKEN unset, unauthenticated attackers can change server environment configuration over the network.
What Is It
CVE-2026-116485 is a missing-authentication flaw (CWE-306) in danmu_api, a project maintained by huangxd-. VulnCheck disclosed it, and it was published to NVD on 2026-10-26. If an instance runs with the default TOKEN and no ADMIN_TOKEN is configured, an attacker can send POST requests to the environment-management endpoints without credentials:
/api/env/set/api/env/add/api/env/del
According to the NVD description, an attacker can use these requests to:
- Set ADMIN_TOKEN themselves and lock out legitimate operators
- Redirect
OTHER_SERVERorPROXY_URL, which enables server-side request forgery (SSRF) - Trigger a redeployment of the service
Why It Matters
VulnCheck scores this flaw 9.8 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. The attack works over the network with low complexity. It needs no privileges and no user interaction, and confidentiality, integrity and availability impacts are all rated high.
The trigger is a default configuration. Any instance that still uses the default TOKEN and has no explicit ADMIN_TOKEN set is exposed. An attacker who succeeds can take administrative control by setting their own ADMIN_TOKEN. Redirecting OTHER_SERVER or PROXY_URL can also turn the server into an SSRF pivot.
Exploitation status: No CISA KEV entry was supplied for this CVE, so KEV does not currently confirm active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined." NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: huangxd-
- Product: danmu_api
- Affected: all versions before 1.21.7
- Unaffected: 1.21.7
You are only exposed if the instance uses the default TOKEN and ADMIN_TOKEN is unset. NVD lists no CPEs for this record.
Patch Status
The fix is in danmu_api 1.21.7. The references include the upstream fix commit (6e93478) and GitHub issue #531. Operators should upgrade to 1.21.7 or later. Based on the conditions in the description, you should also replace the default TOKEN and set an explicit ADMIN_TOKEN. Because this flaw allows configuration changes and lockout, check exposed instances for unexpected changes to ADMIN_TOKEN, OTHER_SERVER and PROXY_URL.
No CISA KEV required action or due date applies, since there is no KEV entry.