Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111643Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

Critical 9.8

In plain English

A critical-severity missing authentication in misaka_danmu_server from l429609201. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 52.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

Affected products (as reported)

Vendor	Product	Versions
l429609201	misaka_danmu_server	0 – through 2.8.9

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication third-party-advisory
https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/config_history.py#L51-L66 technical-description
https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/security.py#L136-L182 technical-description
VulnCheck Advisory: Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback third-party-advisory