EUVD-2026-42932Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Unauthenticated remote HTTP (AV:N/PR:N/UI:N); scope change (S:C) because bypassing the guard exposes upstream provider credentials as a separate authority; low C/I/A reflecting enumeration and proxied-credential abuse rather than full compromise.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.
AnalysisAI
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach protected /v1/* proxy APIs because src/dashboardGuard.js trusts any request arriving over loopback. When 9Router runs behind a same-host reverse proxy that forwards public traffic through 127.0.0.1 - the standard production deployment - external requests are misclassified as local, exposing /v1/models and enabling abuse of configured upstream AI provider credentials. No public exploit identified at time of analysis; scored CVSS 8.3 with a scope change reflecting downstream provider-credential abuse.
Technical ContextAI
9Router is a Node.js AI request router / token-saver that fronts one or more upstream LLM providers and exposes an OpenAI-compatible /v1/* API surface plus a dashboard. Access control is enforced in src/dashboardGuard.js, which distinguishes local (trusted, no API key required) from external (must present an API key) callers. The flaw is a CWE-287 improper-authentication issue: the guard derives 'local' from the requesting socket address rather than an authenticated identity, so it treats the source IP 127.0.0.1 as inherently trusted. In a same-host reverse-proxy topology (e.g. nginx or Caddy proxying public traffic to the backend on localhost) the backend sees every forwarded request as originating from 127.0.0.1, collapsing the local/external distinction. Affected package per CPE is cpe:2.3:a:decolua:9router:*:* for all versions below 0.5.2.
RemediationAI
Vendor-released patch: version 0.5.2 - upgrade 9Router to 0.5.2 or later, which corrects the loopback-trust classification in src/dashboardGuard.js (fix commit da667836cc7584bea0edd893de1d590c9ea279dc; advisory GHSA-x5c9-v98j-722r). If you cannot upgrade immediately, stop relying on source-IP trust: configure the reverse proxy to require and forward an API key for all /v1/* traffic rather than letting 9Router auto-trust loopback, and restrict the backend so only the proxy can reach it. As a compensating control you can require the API key even for local requests (trade-off: breaks any legitimate keyless local tooling), or place authentication at the proxy layer (e.g. proxy-enforced auth on /v1/models and /v1 proxy endpoints) so unauthenticated external callers are rejected before reaching the backend - note this shifts the trust boundary to the proxy and must cover every /v1 path. Rotating any upstream provider credentials configured in 9Router is prudent if you suspect the endpoint was reachable while unpatched.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today