EUVD-2026-109812

danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...

CVE-2026-116485

The danmu_api software (versions prior to 1.21.7 ) is vulnerable to an authentication bypass that allows unauthenticated attackers to modify server environment configurations. This occurs when the application uses the default TOKEN and the ADMIN_TOKEN is unset. By sending POST requests to endpoin...