Threats tagged 'ghsa-m7f5-h255-c4xv'

danmu_api versions before 1.21.7 have an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configurations if the default TOKEN is used and ADMIN_TOKEN is unset. Exploitation involves sending POST requests to specific API endpoints to set ADMIN_TOKEN, lock out legitimate operators, redirect server URLs potentially causing SSRF, and trigger redeployment.