EUVD-2026-84541
GHSA-5mj8-gf6m-fhw8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Remote unauthenticated header spoof (AV:N/AC:L/PR:N/UI:N); low impact - provider/model enumeration (C:L), unauthorized LLM use (I:L), and paid-credit consumption (A:L); wrapper-less deployment is environmental, not attacker complexity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.
AnalysisAI
Authentication bypass in 9Router (npm package '9router') before 0.5.6 lets a remote, unauthenticated attacker reach the public LLM API under /api/v1/* by simply adding the header X-9r-Real-Ip: 127.0.0.1, which the application's isLocalRequest() logic in src/dashboardGuard.js trusts when deciding whether canAccessPublicLlmApi() may skip API-key validation. Successful abuse grants unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models; the verified affected route is GET /api/v1/models. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only when the instance is deployed in a mode where requests reach Next.js directly WITHOUT the bundled custom-server.js wrapper (which normally derives the client IP from the unspoofable TCP socket and strips any inbound X-9r-Real-Ip), AND the LLM API (/api/v1/*) is network-reachable to the attacker (default bind is 0.0.0.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3) describes a network-reachable, low-complexity, unauthenticated bypass with low impact across all three dimensions, which matches the description: a remote unauthenticated attacker spoofs X-9r-Real-Ip: 127.0.0.1 to be treated as a loopback client and skip API-key validation on /api/v1/*. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade 9Router to a patched release: the vendor advisory GHSA-5mj8-gf6m-fhw8 and release tag v0.5.6 identify 0.5.6 as the fix, while package registry metadata lists 0.5.8 as the fixed version, so deploying 0.5.8 or later is the safest course and the upstream fix is contained in commit efd20be8d81ef2e256a7037f3aa78e6b567b5fd3 (see https://github.com/decolua/9router/releases/tag/v0.5.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of the npm package '9router' before 0.5.6 and immediately restrict network access to /api/v1/* endpoints by binding the service to localhost or an internal interface, blocking external access, and ensuring requests are routed through the bundled custom-server.js wrapper where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a bi
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today