Hard-Coded Secrets and Unauthenticated APIs: 4 CVEs at 9.8 in LangChat, DataBuff, Simple Admin Core and Misaka Danmu

On October 16, 2026, NVD published four CVEs rated 9.8 in open source projects you deploy yourself: an LLM chat platform, an APM tool, an admin framework and a media server.

None of them is subtle. They are the oldest mistakes in the trade: a default admin password, a signing secret published in the repository, APIs no authentication check protects. They're worth an article because they expose a blind spot in vulnerability monitoring, explained below.

All four: CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3, published by VulnCheck (CNA). None is in CISA KEV at the time of writing. NVD gives no fixed version.

LangChat — CVE-2026-111704

An AI chat and agent platform. No Sa-Token interceptor is registered, so the REST controllers answer without authentication. According to NVD's description, a request to /api/v1/auth/users returns plaintext passwords, and the API lets anyone retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

The LLM API keys deserve particular attention: once stolen, they're used to burn credit at your expense or run abusive workloads under your account. Rotate them if an instance was exposed, even with no sign of intrusion.

DataBuff ai-apm-web — CVE-2026-111693

An application observability tool. The built-in admin account ships with a default password documented in the code, which NVD's description quotes verbatim. One login request is enough to get an administrator token and reach every protected route.

Action: change that password now on every instance, exposed or not.

Simple Admin Core — CVE-2026-111690

An admin framework (users, roles, menus, API permissions). The secret that signs JWT tokens, Auth.AccessSecret, is hard-coded in api/etc/core.yaml, published with the repository. Anyone can sign a token with it and a super-admin role claim, and take full control of the application.

Action: set a per-deployment secret. NVD references a project pull request (#382): check whether it's merged in your version. Changing the secret invalidates every existing token, including any an attacker may have forged.

Misaka Danmu Server — CVE-2026-111643

A synchronized comment ("danmu") server for media players. The POST /api/ui/config-history/rollback endpoint is unprotected and lets anyone write any configuration key. By adding their own address to ipWhitelist, or changing trustedProxies or webhookApiKey, an attacker then reaches every protected endpoint as the administrator.

The Blind Spot: CVEs NVD Won't Analyze

All four entries are marked "Deferred" in NVD: NVD has decided not to enrich them. In practice, they will get no CPE configuration — no standardized product identifier.

Yet most monitoring tools — and vulnerability scanners — match CVEs to your assets by CPE. A CVE with no CPE matches nothing: it will never surface, however critical it is. It's the same mechanism as the "Awaiting Analysis" trap, except permanent.

For niche open source projects, that's the rule rather than the exception. If you run any, monitoring has to work by product name in the description too, not only by CPE.

Detection

• LangChat: anonymous requests to /api/v1/ in reverse proxy logs; unknown super-admin accounts; abnormal usage at your LLM providers.
• DataBuff: successful logins to the admin account from unexpected addresses.
• Simple Admin Core: valid tokens issued for unusual users or at unusual times; new roles or API permissions.
• Misaka Danmu: configuration history — any change to ipWhitelist, trustedProxies or webhookApiKey you didn't make.

Mitigation

1. Don't expose these applications directly to the internet: put them behind a VPN, or a reverse proxy with authentication.
2. Change every default secret: passwords, JWT secrets, API keys.
3. Rotate the credentials the application holds (LLM keys, webhook tokens, database access).
4. Watch each project's repository for the fix: no fixed version is published in NVD.

Why Continuous Monitoring of Your Self-Hosted Applications Matters

Four critical flaws, four projects, and none will surface by CPE. Monitoring self-hosted open source can't rely on NVD enrichment alone.

With cveo.tech, add your applications to your inventory: monitoring combines CPE matching with product-name search, so CVEs NVD hasn't analyzed reach you too.