Misaka Danmu Server versions through 2.8.9 contain an authentication bypass that enables an unauthenticated attacker to send a POST request to the /api/ui/config-history/rollback endpoint and write arbitrary configuration keys. This occurs due to missing authentication checks, a CWE‑306 weakness. By setting keys such as ipWhitelist, trustedProxies, or webhookApiKey, the attacker can effectively add themselves to the trusted list, modify proxy settings, or gain API secrets, allowing full administrative control over every protected endpoint in the application.

The vulnerability affects all instances of Misaka Danmu Server released up through and including version 2.8.9. Any deployment of this product without the corresponding upstream patch is vulnerable.

The vulnerability receives a CVSS score of 9.3, indicating high severity. EPSS data is not available, but the lack of authentication on a public API endpoint makes exploitation technically straightforward for remote attackers with network access. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by issuing unauthenticated HTTP requests to the affected endpoint, assuming normal network connectivity to the server. Given the potential for full administrative takeover, prompt remediation is essential.