EUVD-2026-44813Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-reachable endpoint, low complexity; PR:L because valid account required; S:C for out-of-scope credential exfiltration; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443
and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.
AnalysisAI
Server-side request forgery (SSRF) in 9Router's Kiro API-key validation endpoint allows authenticated attackers to redirect outbound validation requests to an attacker-controlled host, exfiltrating the submitted Kiro API key via the Authorization header. Affected are all 9Router deployments prior to version 0.5.6 where the Kiro OAuth provider is configured. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack is low-complexity once authenticated. Vendor-released patch is available in v0.5.6.
Technical ContextAI
9Router is a Next.js-based AI request router that proxies and multiplexes LLM API calls. The vulnerable endpoint at POST /api/oauth/kiro/api-key accepts a user-supplied region string and interpolates it directly into an upstream AWS OIDC URL of the form https://oidc.${region}.amazonaws.com/token without any allowlist validation. By supplying a crafted region value such as 'kiro-canary.local:8443#', the '#' URL fragment character causes the remainder of the legitimate hostname ('.amazonaws.com/token') to be treated as a fragment - effectively truncating the URL - and routing the HTTP request to the attacker-controlled host. This is a classic CWE-20 (Improper Input Validation) leading to SSRF. The affected CPE is cpe:2.3:a:decolua:9router:*:*:*:*:*:*:*:*. The scope change (S:C) in the CVSS vector reflects that the impact propagates to an out-of-scope system (the attacker's server receiving the credential).
RemediationAI
Upgrade to 9Router v0.5.6, which introduces an AWS region allowlist regex (/^[a-z]{2}-[a-z]+-\d{1,2}$/) via the assertValidAwsRegion() function applied across all region interpolation points in KiroService and related providers, preventing arbitrary host injection. The fix is confirmed in the tagged release at https://github.com/decolua/9router/releases/tag/v0.5.6 and commit https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f. If immediate upgrade is not possible, operators can restrict access to the POST /api/oauth/kiro/api-key endpoint to trusted internal networks only via reverse-proxy ACLs; this eliminates remote exploitation but may break legitimate Kiro OAuth flows for external users. Disabling the Kiro OAuth provider entirely is a more disruptive but complete compensating control.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today