---
id: "CVE-2026-111643"
kind: "vulnerability"
aliases: ["CVE-2026-111643"]
title: "Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "misaka_danmu_server", "fixed": [], "affected": "<= 2.8.9", "ecosystem": "github"}]
ecosystems: []
tags: ["authentication-bypass", "docker", "misaka-danmu-server", "other", "self-hosted"]
not_affected_if: ["behind-vpn", "not-internet-exposed", "version-above-2.8.9"]
published_at: "2026-10-16T18:17:45+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111643", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:31:01+00:00"}]
---

# Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated…

Misaka Danmu Server <= 2.8.9 (self-hosted danmaku server) applies auth per endpoint, and several /api/ui routers have none. POST /api/ui/config-history/rollback takes an arbitrary key/value and upserts it into config with no login. An attacker sets ipWhitelist to their own /32, and check_ip_whitelist then treats them as admin on every protected endpoint. Trusted proxies and webhookApiKey can also be changed. Routers are registered by default. Other unauthenticated endpoints leak audit and server logs, list the library, and delete rows or clear audit logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:misaka_danmu_server affected <= 2.8.9 fixed ?

## How to check

Run: curl -i -X POST http://HOST:7768/api/ui/config-history/rollback -H 'Content-Type: application/json' -d '{}'. A 200 with {"message":"key is required"} means the endpoint is open (an empty key writes nothing); 401/403 means it is protected. Also check the version (<= 2.8.9). Review the config table for unexpected ipWhitelist, trustedProxies or webhookApiKey values, and GET /api/ui/config-history for rollback entries.

## Fix

No fixed version published as of 2026-10-23 (2.8.9 is the latest release). Until one exists: do not expose the port to the internet or untrusted LANs, and put it behind a reverse proxy or VPN that blocks /api/ui/config-history, /api/ui/audit, /api/ui/diagnostics and /api/ui/data-check. If exposed, check ipWhitelist and rotate the admin password, API tokens and webhookApiKey. Watch the GitHub releases page.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111643
- 2026-10-23T23:31:01+00:00 analyst — Read VulnCheck advisory and researcher write-up (source-derived, not executed). No fixed release found: v2.8.9 (22 Aug) is the latest on the GitHub releases page; no vendor advisory seen. No public working exploit, no exploitation reports; x/social not searched (obscure project).

## Documents

- [advisory] VulnCheck: Misaka Danmu Server <= 2.8.9 auth bypass via config-history rollback https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-authentication-bypass-via-config-history-rollback
- [describes] hieuPenguinnn: unauthenticated /api/ui endpoints and arbitrary config write (source-derived, not executed) https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication
- [mentions] misaka_danmu_server releases (latest listed: v2.8.9) https://github.com/l429609201/misaka_danmu_server/releases

## From the sources

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_