Misaka Danmu Server: Authentication bypass via config-history rollback
Summary
Misaka Danmu Server through version 2.8.9 contains an authentication bypass in the unprotected endpoint POST /api/ui/config-history/rollback. An unauthenticated attacker can write arbitrary configuration keys, for example set the ipWhitelist key to their own address or change trustedProxies and webhookApiKey. This grants access to all protected endpoints with administrator rights.
Affected
- Misaka Danmu Server through 2.8.9
- Default configuration: unaffected (per CVE record)
Fixed in
- Fixed version: 2.9.0 according to VulDB (third-party statement, not yet confirmed in vendor release notes)
- Vendor advisory: Unknown.
Workaround
- Unknown: no vendor-confirmed workaround.
- Restrict access to /api/ui/config-history/rollback to trusted internal IP ranges via firewall rules, as recommended by VulDB.
- Do not expose the admin UI or API to the internet; use LAN or VPN access only.
Exploitation
- Attack requires no authentication and no user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N).
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: total.
- Known exploited (KEV): no.
- A working public proof of concept could not be verified.
- Remote code execution is not supported by the CVE text and remains unverified.
Our recommendation
- Search asset inventory and external scans for Misaka Danmu Server, including NAS, homelab, media servers and Docker containers.
- If found and internet-exposed, restrict access or take the service offline immediately.
- Upgrade to a version later than 2.8.9 after confirming the fixed version on the project's GitHub releases page.
- Review ipWhitelist, trustedProxies and webhookApiKey for unexpected values; rotate the webhook key and administrator credentials if the instance was exposed.
- Check logs for unexplained config-history rollback requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD/CVE record references: GitHub config_history.py (v2.8.9) github.com
- GitHub security.py (v2.8.9) github.com
- HackMD write-up: missing authentication hackmd.io
- VulnCheck advisory www.vulncheck.com
- VulDB CVE entry vuldb.com
- Project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:26.
Original description (NVD)
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
NVD references (5)
- https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/config_history.py#L51-L66
- https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/security.py#L136-L182
- https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication
- https://www.vulncheck.com/advisories/misaka-danmu-server-through-2.8.9-authentication-bypass-via-config-histo…
- https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.