The vulnerability exists in 9router's POST /api/auth/oidc/test endpoint where the user-controlled issuerUrl parameter is passed to fetchOidcDiscovery() without restrictions on private or loopback destinations. This lack of validation enables unauthenticated attackers to perform internal service scanning and reflect OIDC discovery fields such as token_endpoint and jwks_uri. The issue affects versions up to and including 0.5.4. The CVSS 3.1 score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An unauthenticated attacker can exploit this vulnerability to scan internal services and obtain sensitive OIDC discovery information, potentially leading to further attacks on internal infrastructure. The vulnerability impacts confidentiality (low), integrity (high), and availability (low) of the affected system.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and disable the vulnerable feature if possible. Monitor for updates from the vendor regarding patches.