EUVD-2026-44812Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint needs a low-privilege authenticated account (PR:L, AC:L); disabling auth exposes secrets (C:H) and mutates persistent settings (I:H), with minor availability effect (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.
AnalysisAI
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable application-wide login by abusing a mass-assignment flaw in the PATCH /api/settings endpoint. Because the endpoint persists the entire request body without a field whitelist, a low-privileged user can flip security-critical settings such as requireLogin, thereby exposing sensitive routes like /api/keys and /api/providers to unauthenticated access. No public exploit identified at time of analysis; the issue is fixed in version 0.5.4.
Technical ContextAI
9Router is a self-hosted AI request router / token-saving proxy (vendor 'decolua', CPE cpe:2.3:a:decolua:9router). The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes, i.e. mass assignment): the PATCH /api/settings handler binds the full JSON request body directly onto the persistent settings object instead of allowlisting the specific, user-editable fields. This lets a client reach configuration attributes that were never meant to be exposed through that endpoint - notably the requireLogin authentication toggle - and have them written to durable storage, which then governs access control for the whole application.
RemediationAI
Vendor-released patch: upgrade to 9Router 0.5.4, which reportedly fixes the mass-assignment flaw; this is the primary and recommended action (see https://github.com/decolua/9router/security/advisories/GHSA-vmjq-hvgq-2wv4). If you cannot upgrade immediately, restrict who can reach the PATCH /api/settings endpoint - place 9Router behind a reverse proxy or network ACL that limits settings changes to trusted administrators, and treat any low-privilege account as capable of full auth bypass until patched (trade-off: proxy-level path filtering may break legitimate settings edits for non-admin users). Additionally, avoid granting accounts to untrusted users on unpatched instances, and after patching verify that requireLogin is still enabled and that /api/keys and /api/providers require authentication, rotating any AI provider API keys that may have been exposed while the instance was vulnerable.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today