EUVD-2026-42930
GHSA-86m2-fcxq-5q7c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Remote, no-auth, single-header bypass gives AV:N/AC:L/PR:N/UI:N; credential/metadata disclosure is C:H with limited I:L, and the SSRF pivot to other systems justifies S:C.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/search with the searxng provider_options.baseUrl parameter to drive server-side requests to internal or cloud-metadata hosts. This issue is fixed in version 0.5.2.
AnalysisAI
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: localhost' header so the /v1 LLM proxy treats the request as local and skips API-key checks. Once past authentication, an attacker abuses stored provider credentials for upstream LLM calls and leverages /v1/search's searxng provider_options.baseUrl to force server-side requests to internal or cloud-metadata endpoints (SSRF). No public exploit identified at time of analysis, though the fixing commit is public, and EPSS/KEV signals are not provided.
Technical ContextAI
9Router is a self-hosted AI/LLM router and token-saving proxy that fronts multiple upstream providers and gates its /v1 endpoints behind an API key. The flaw is a classic CWE-290 (Authentication Bypass by Spoofing): the 'local request' trust decision is derived from the client-supplied Host header rather than from the actual transport source (socket peer address or a trusted reverse-proxy header). Because HTTP Host is fully attacker-controlled, sending Host: localhost impersonates a loopback client. A secondary weakness compounds this: the /v1/search route with the searxng backend accepts a caller-supplied provider_options.baseUrl, turning the trusted proxy into an SSRF pivot toward RFC1918 internal services and cloud metadata endpoints (e.g., 169.254.169.254). Per CPE cpe:2.3:a:decolua:9router, all versions prior to 0.5.2 are affected.
RemediationAI
Vendor-released patch: version 0.5.2 - upgrade all 9Router instances to 0.5.2 or later, which corrects how local/loopback requests are determined (fix commit b282f0554972ea35281520738759d76abcd0b0b3; advisory GHSA-86m2-fcxq-5q7c). If you cannot upgrade immediately, place 9Router behind a reverse proxy or firewall so that only trusted networks can reach the /v1 endpoints, and configure the proxy to strip or normalize inbound Host headers so external clients cannot assert Host: localhost (trade-off: may require pinning an expected Host/virtual-host and can break multi-host setups). Additionally, restrict outbound network egress from the 9Router host to block access to link-local metadata (169.254.169.254) and internal RFC1918 ranges to blunt the /v1/search SSRF (trade-off: legitimate internal search backends must be explicitly allowlisted), and where feasible disable or restrict the searxng provider or the caller-supplied provider_options.baseUrl parameter. Rotate any provider API keys/credentials stored in 9Router if internet exposure predates patching.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today