Threat Intelligence Database

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.

CVE-2026-56677 is a high-severity vulnerability in decolua 9router versions 0.5.4 and earlier. It involves a missing authentication check on the POST /api/auth/oidc/test endpoint, which allows unauthenticated attackers to scan internal services and retrieve OpenID Connect discovery information when dashboard login is disabled.

9Router versions prior to 0.4.72 contain a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. This endpoint accepts a user-controlled URL parameter that is only syntactically validated without blocking private IP ranges or internal hostnames. An authenticated or locally connected user can exploit this to make the server fetch arbitrary internal URLs, potentially exposing cloud metadata credentials and internal services. The vulnerability has a high severity with a CVSS score of 8.3.

9Router versions prior to 0.5.2 contain an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary code on the host system. This is achieved by bypassing localhost-only route restrictions via the Host header and passing unvalidated arguments to child_process.spawn() through the /api/mcp//sse endpoint. The vulnerability is fixed in version 0.5.2.

CVE-2026-56678 is an improper input validation vulnerability in decolua 9router versions prior to 0.5.6. The issue occurs in the Kiro API-key validation endpoint, where a user-controlled region value is used to build an upstream URL. An authenticated attacker can supply a crafted region value to redirect the validation request to an attacker-controlled host, leaking the Kiro API key in the Authorization header. This vulnerability is fixed in version 0.5.6.

CVE-2026-56679 affects decolua 9router versions prior to 0.5.4. The vulnerability allows an authenticated user to modify security-critical settings via the PATCH /api/settings endpoint because the request body is written to persistent settings without a field whitelist. This can disable authentication for the entire application, exposing protected routes to unauthenticated access. The issue is fixed in version 0.5.4.

9Router versions from 0.4.30 up to but not including 0.4.37 contain an OS command injection vulnerability in the src/proxy.js middleware. This flaw allows unauthenticated attackers to register custom plugins and execute commands via the MCP bridge due to insufficient protection of certain API endpoints. The vulnerability is fixed starting with version 0.4.37.

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.