CVE-2026-59801 describes an unauthenticated access vulnerability in decolua 9Router through version 0.4.41. The issue arises from missing authentication middleware in Next.js API routes under src/app/api/providers/*. This flaw permits remote attackers to interact with provider management APIs without any credentials, allowing enumeration, creation, modification, or deletion of provider connections. The vulnerability can lead to exposure of partial credentials, OAuth tokens, and API keys, redirection of AI traffic to malicious servers, or complete denial of service by deleting all provider connections. The CVSS 4.0 score is 9.3, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor.

Remote attackers can fully control provider connections without authentication, exposing sensitive credentials and tokens. They can redirect AI traffic to attacker-controlled servers or cause denial of service by deleting all provider connections. This compromises confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected API endpoints and monitor for suspicious activity. Implement custom authentication or access controls as a temporary mitigation if possible.