L429609201 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting L429609201 products: 2 record(s), with severity, exploitation and fixes.

Misaka Danmu Server 2

Exploited only (KEV) →

CVE-2026-111644 High · 7.3 CWE-306 Oct 16, 2026

Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes

Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history.

CVE-2026-111643 Critical · 9.8 CWE-306 Oct 16, 2026

Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.