{"id":"CVE-2026-111643","published":"2026-10-16T18:17:45.013","lastModified":"2026-10-16T19:03:18.127","description":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/config_history.py#L51-L66","tags":[]},{"url":"https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/security.py#L136-L182","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication","tags":[]},{"url":"https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-authentication-bypass-via-config-history-rollback","tags":[]}],"exploitRefs":[{"url":"https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/config_history.py#L51-L66","tags":[]},{"url":"https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/security.py#L136-L182","tags":[]}],"hasPoc":true,"ai":{"summary":"The Misaka Danmu Server contains an authentication bypass vulnerability in its configuration API that allows unauthenticated attackers to modify critical configuration settings like IP whitelists and trusted proxies, effectively granting them administrative access to the entire system.","exploitability":"Exploitation is straightforward requiring only a single POST request to the unprotected /api/ui/config-history/rollback endpoint with crafted configuration data, with no authentication or additional preconditions needed.","blast_radius":"The vulnerability could allow attackers to completely compromise the server by gaining administrative access to all protected endpoints, potentially leading to full system takeover and unauthorized configuration of network access controls.","remediation":"Upgrade to version 2.8.10 or later to address this authentication bypass vulnerability.","detection":"Monitor for POST requests to /api/ui/config-history/rollback endpoint with suspicious configuration changes, particularly modifications to ipWhitelist, trustedProxies, and webhookApiKey fields in server logs.","tags":["auth-bypass","config","web"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:46:28.858Z"}}