9Router CVE-2026-56682

Exploitable only when 9Router is deployed so that HTTP requests reach Next.js directly WITHOUT the bundled custom-server.js wrapper that normally overwrites X-9r-Real-Ip from the unspoofable TCP socket address; in that mode the login endpoint (POST /api/auth/login, default bind 0.0.0.0) trusts the attacker-supplied X-9r-Real-Ip header as the loginLimiter bucket key. The attacker needs no authentication or user interaction and simply rotates the header per request to defeat the five-attempt progressive lockout. Realistic impact is LIMITED by: (1) the non-default deployment requirement (missing/bypassed custom-server.js sanitizer), and (2) the fact that administrative takeover still requires the dashboard password to be weak or guessable - the flaw only removes the throttle, it does not itself yield credentials.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium) reflects a network-reachable, unauthenticated, low-complexity flaw whose direct technical impact is limited to confidentiality (C:L) - it removes brute-force throttling rather than directly disclosing data or granting code execution. Crucially, the vulnerability is gated on a non-default deployment mode: requests must reach Next.js WITHOUT the bundled custom-server.js wrapper, so the header is attacker-controlled. That deployment precondition is not captured in the vendor's AC:L and realistically raises attack complexity (I lean AC:H). There is no EPSS score, no CISA KEV listing, and no distinct public exploit artifact provided, so this is no public exploit identified at time of analysis - though the GHSA advisory states the bypass was reproduced against a live instance (header rotation yielding unlimited 401s vs. 429 lockout on a fixed header), which raises confidence the weakness is real and trivially triggerable. Real-world priority is LOW-to-MEDIUM: even successful exploitation only enables unthrottled guessing, and administrative takeover still depends on a weak/guessable dashboard password. Combined with the product's tiny deployment footprint, this is a genuine-but-narrow issue rather than a widespread emergency. Note a data conflict: the description and release tag say fixed in 0.5.6 while the package intelligence lists vulnerable <=0.5.4 and fixed in 0.5.8 - verify the exact fixed version with the vendor.

An operator deploys 9Router in a mode that bypasses the custom-server.js sanitizer (e.g., serving Next.js directly, default bind 0.0.0.0), so the client-supplied X-9r-Real-Ip header reaches getClientIp unmodified. A remote unauthenticated attacker scripts password guesses against POST /api/auth/login, assigning a fresh X-9r-Real-Ip value (10.0.0.1, 10.0.0.2, ...) on each request so every guess lands in a new lockout bucket and the five-attempt 429 progressive lock never fires, permitting unlimited guessing until the admin password is recovered. No standalone public exploit code is published, but the advisory documents a working reproduction against a live instance.