CVE-2026-62327 is a critical unauthenticated information disclosure vulnerability in decolua's 9Router product through version 0.4.41. The vulnerability arises from missing authentication middleware on the Next.js API route /api/usage/stats, allowing remote attackers to retrieve plaintext API keys, token counts, cost breakdowns, and request metadata for all connected AI provider accounts. This exposure enables attackers to misuse the AI accounts, potentially causing billing fraud and exhausting usage quotas. The CVSS 4.0 base score is 9.3, reflecting high impact and ease of exploitation without privileges or user interaction. No official patch or remediation guidance is currently provided by the vendor, and no known exploits in the wild have been reported.

Attackers can remotely obtain plaintext API keys and detailed usage data without authentication, leading to unauthorized access to AI provider accounts. This can result in billing fraud, quota exhaustion, and unauthorized use of services tied to these API keys. The vulnerability affects confidentiality and availability of the service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint through network controls or implement custom authentication middleware to prevent unauthenticated access to /api/usage/stats.