CVE-2026-116485

Name of the Vulnerable Software and Affected Versions danmu api versions prior to 1.21.7

Description An authentication bypass occurs when the default TOKEN is used and the ADMIN TOKEN is unset. This allows unauthenticated attackers to modify server environment configurations by sending POST requests to the endpoints '/api/env/set', '/api/env/add', or '/api/env/del'. Potential impacts include setting the ADMIN TOKEN to lock out operators, redirecting OTHER SERVER or PROXY URL to facilitate Server-Side Request Forgery (SSRF)—a technique where an attacker forces a server to make requests to an unintended location—and triggering redeployment.

Recommendations Update to version 1.21.7.