CVE-2026-116485

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 2.35%
EPSS Percentile: 83.69%
CISA KEV: Not listed

Description

danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 26-Oct-2026 21:16
Last Modified: 27-Oct-2026 01:41
EPSS Date: 2026-10-31
CWE: CWE-306

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 01-Nov-2026 02:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

CVE-2026-116485 – danmu_api CYFIRMA’s Fortnightly Exploit Radar Highlights Five Vulnerabilities

CVE (4)

Vendors (1)

Products (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.