Unauthenticated attackers can reach the /api/env endpoints and alter environment variables when the application is running with the default TOKEN and no ADMIN_TOKEN has been set. This allows the attacker to set or change ADMIN_TOKEN, lock out existing operators, redirect the OTHER_SERVER or PROXY_URL parameters to malicious destinations creating a Server‑Side Request Forgery vector, and trigger a redeployment of the service. The weakness is a classic credential exposure (CWE‑306), enabling full configuration control without proper authentication.

The vulnerability affects the danmu_api application from the vendor huangxd‑:danmu_api, specifically all releases before version 1.21.7. No additional vendor versions or sub‑components are listed in the CNA data.

The CVSS base score of 9.3 marks this issue as critical. Because the exploit can be performed over the network via simple POST requests to publicly reachable endpoints and the EPSS value is not available, there is no formal estimate of exploitation frequency, but the lack of authentication and default token usage make successful attacks highly likely. The vulnerability is not yet listed in CISA’s KEV catalog, yet its severity and the unprotected nature of the endpoints imply an urgent response.