External risk intelligence

Misaka Danmu Server Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-111643

The vulnerability exists in an API endpoint (/api/ui/config-history/rollback) of a server application designed for public-facing functionality, such as a danmu (comment) server. These services are commonly deployed as internet-facing web applications or API services to support real-time user interactions, making them reachable and accessible from the public internet.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Misaka Danmu Server allows unauthenticated attackers to bypass authentication and gain administrative control by writing arbitrary configuration keys. This could enable unauthorized access and modification of system settings.

Unauthenticated users can take control of the server.
Protects administrative access and system integrity.
Confirm if this server is in use and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can bypass security controls by sending a request to a specific server endpoint. This allows them to manipulate configuration settings, potentially gaining administrator privileges and full control over the system.

No authentication required.
POST to /api/ui/config-history/rollback.
Full administrator access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication and gain administrator access to the Misaka Danmu Server. Supported conditions include when the server is exposed to the network.

Server configuration data at risk.
Bypassing authentication on a POST request.
Unauthorized administrator control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Misaka Danmu Server, allowing unauthenticated attackers to bypass authentication and modify critical configurations, likely impacts application owners and platform teams responsible for the server's deployment and maintenance. The first practical step is to identify all instances of the affected server, determine their exposure and business criticality, identify the accountable owner, and then plan remediation or risk reduction activities.

Application and platform owners should manage the issue.
Verify network reachability and business impact.
Plan phased remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Misaka Danmu Server?

Misaka Danmu Server is a software application designed to manage real-time comment streams, commonly known as danmu, which appear over video content. These servers handle incoming user interactions and process the synchronization of these messages in web environments. By maintaining configuration settings and API endpoints, the server facilitates the delivery of interactive features during video playback, requiring it to handle network requests to ensure that user comments are distributed correctly to...

How does CVE-2026-111643 work as an authentication bypass?

This vulnerability is classified as CWE-306, which refers to Missing Authentication for Critical Function. In this specific case, the software fails to verify user credentials before allowing access to a configuration rollback endpoint. Because the system assumes the request is authorized, an attacker can submit malicious configuration changes directly to the server, effectively ignoring the security mechanisms designed to restrict administrative commands to legitimate users.

What triggers this vulnerability in the server?

The vulnerability is triggered when an attacker sends a specially crafted POST request to the specific endpoint located at /api/ui/config-history/rollback. This path does not require any authentication, meaning the server processes the request without checking if the sender is an administrator. Simply visiting the page or using a GET request will not trigger the modification; the attack requires the specific POST action to update the configuration keys.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is highly relevant because Misaka Danmu Server is typically designed for public-facing use. Since the service often sits on the internet to receive real-time comments from many users, it is directly reachable by unauthorized parties. If your instance is exposed to the public internet, it falls into the category of high-risk assets, as there is no network-level barrier stopping external requests to the vulnerable API.

What should I do if I run this software?

The immediate priority is to locate all instances of Misaka Danmu Server within your environment to assess their network accessibility. Once identified, evaluate the business impact of each server and determine who is responsible for its maintenance. Since the issue allows for unauthorized administrative control, you should prioritize restricting access to the server's API endpoints at the network level while you investigate options for vendor updates or configuration changes to mitigate the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.