Misaka Danmu Server Auth Bypass Allows Admin Takeover in Versions Through 2.8.9

An unauthenticated authentication bypass in Misaka Danmu Server allows attackers to rewrite core configuration settings. This flaw, tracked as CVE-2026-111643, enables full administrative takeover without valid credentials.

What happened

Misaka Danmu Server versions through 2.8.9 contain an authentication bypass vulnerability. According to the National Vulnerability Database, the flaw allows unauthenticated attackers to write arbitrary configuration keys. The attack vector is an unprotected POST endpoint at `/api/ui/config-history/rollback`. This endpoint lacks proper access controls, permitting external actors to modify server settings directly.

Attackers can exploit this endpoint to set the `ipWhitelist` key to their own /32 address. They can also alter the `trustedProxies` and `webhookApiKey` configuration values. These changes allow the attacker to access every protected endpoint as the administrator. The weakness is classified as CWE-306, which relates to improper authentication handling.

Why it matters

The impact is severe because it grants immediate administrative access. Attackers do not need to guess passwords or exploit complex logic flaws. They simply send a request to the rollback endpoint to change access controls. This type of critical bypass highlights the risk of unprotected management interfaces.

Environments running Misaka Danmu Server up to version 2.8.9 are exposed. The ability to modify `webhookApiKey` and `trustedProxies` undermines the integrity of the entire service. Defenders must recognize that standard authentication checks are completely bypassed for this specific path.

What to watch

• Monitor for unauthorized POST requests to configuration rollback endpoints.
• Check logs for unexpected changes to IP whitelists or trusted proxies.
• Verify that administrative actions originate from known management networks.
• Alert on any modification of webhook API keys by unauthenticated users.

Signals worth monitoring

Security teams usually detect this type of bypass by analyzing web server access logs for unusual POST requests to configuration management paths. Look for requests to endpoints that handle version rollbacks or history restoration, especially from unfamiliar IP addresses. Check whether configuration audit trails show sudden changes to access control lists or API credentials. Teams should verify that all administrative modifications are preceded by valid authentication tokens. If logs show configuration updates without corresponding login events, isolate the affected instance immediately.

What to do and how to stay safe: Misaka Danmu Server

• Scan your network to identify all instances of Misaka Danmu Server running versions through 2.8.9.
• Restrict network access to the `/api/ui/config-history/rollback` endpoint using firewalls or web application firewalls.
• Monitor configuration files for unauthorized changes to `ipWhitelist`, `trustedProxies`, and `webhookApiKey`.
• Once the vendor provides an update, apply the patch immediately to fix the authentication bypass.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Misaka Danmu Server are affected by CVE-2026-111643?

All versions of Misaka Danmu Server through 2.8.9 are affected by this authentication bypass vulnerability.

How do attackers exploit this vulnerability to gain access?

Attackers send POST requests to the unprotected `/api/ui/config-history/rollback` endpoint to rewrite configuration keys.

What configuration keys can be modified by an unauthenticated attacker?

Attackers can modify the ipWhitelist, trustedProxies, and webhookApiKey settings to gain administrative access.