9router uses a hardcoded fallback JWT secret "9router-default-secret-change-me" for signing dashboard session JWTs if the JWT_SECRET environment variable is unset. This secret is publicly known and unchanged across all releases from version 0.2.21 through 0.4.41. An attacker can forge valid JWT tokens signed with this secret to bypass authentication and gain full access to the dashboard and API. The vulnerability was introduced in commit 23cfb19 and persists due to fallback usage rather than requiring a configured secret. Exploitation allows reading and modifying sensitive data including API keys and passwords, and enables further pivoting via other exposed interfaces. The recommended remediation is to enforce the presence of a JWT_SECRET environment variable at startup, failing fast if missing, to prevent use of the hardcoded secret.

Exploitation allows unauthenticated remote attackers to bypass authentication by forging JWT tokens signed with the known fallback secret. This grants full access to the 9router dashboard and API, enabling attackers to read API keys and authentication tokens, change passwords, shut down the router, and modify all settings. Additionally, attackers can pivot through other exposed interfaces such as the MCP stdio→SSE bridge. The impact is complete compromise of the affected 9router instances that do not have JWT_SECRET set.

No official patch is currently documented. The recommended mitigation is to configure the JWT_SECRET environment variable with a strong secret and ensure the application fails to start if JWT_SECRET is not set, preventing fallback to the hardcoded default. Alternatively, generate and persist a random secret on first boot but never use the publicly known fallback secret. Operators should verify their 9router instances do not rely on the default secret and update configurations accordingly.