EUVD-2026-20853Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Impact | This vulnerability presents moderate real-world risk despite a CVSS score of 6.9. The exploitation signals are aligned: CVSS indicates network-accessible, unauthenticated attack surface (PR:N, AV:N) with low complexity; the E:P flag (Exploit Proof-of-Concept Mature) confirms publicly available exploit code; and patch availability from the vendor (v0.3.75) provides a clear remediation path. However, the CVSS Impact metrics show limited scope-only confidentiality (VC:L), integrity (VI:L), and availability (VA:L) at low severity within the vulnerable component itself, with no impact on system-wide confidentiality, integrity, or availability (SC:N, SI:N, SA:N). This suggests the bypass grants access to administrative functions but does not immediately enable critical data exfiltration, modification, or system-wide denial of service without further exploitation. The risk is highest for internet-exposed 9router instances running versions 0.3.47 or earlier; patched deployments are protected. Organizations should prioritize patching vulnerable instances promptly, but this is not a critical zero-day requiring emergency response-it is a disclosed vulnerability with tooling available for exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker on the internet discovers a decolua 9router instance with version 0.3.47 or earlier running on a network-accessible IP address. The attacker uses publicly available exploit code from https://github.com/deepcat1337/Free_Api_Exploit/tree/main to send a crafted HTTP request to the /api endpoint, bypassing authorization checks and gaining access to administrative functions such as configuration retrieval, user enumeration, or system parameter modification. No credentials, user interaction, or complex attack prerequisites are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access the Administrative API Endpoint (/api) without proper credentials, potentially exposing sensitive functionality. The vulnerability has publicly available exploit code and vendor-released patch version 0.3.75 is available, reducing real-world risk for patched deployments but creating urgency for unpatched instances given active public disclosures.
RemediationAI
Vendor-released patch: upgrade decolua 9router to version 0.3.75 or later, available at https://github.com/decolua/9router/releases/tag/v0.3.75. For organizations unable to patch immediately, restrict network access to the /api endpoint using firewall rules or reverse proxy authentication, limiting exposure to trusted administrative networks only. Verify the patch installation by confirming the application version and testing administrative API access with invalid credentials to confirm authorization checks are enforced. Review the advisory and fix details at https://github.com/decolua/9router/issues/431 and related commentary in the referenced GitHub commit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Administrative API Endpoint (/api) of decolua 9router, a routing or network management component. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that the authentication or authorization mechanism fails to properly validate user privileges before granting access to administrative functions. The CVSS 4.0 vector shows this is a network-accessible endpoint (AV:N) with low attack complexity (AC:L) requiring no authentication (PR:N) or user interaction (UI:N), meaning any remote attacker can trigger the bypass. The affected product range spans all versions up to and including 0.3.47 per the CPE specification cpe:2.3:a:decolua:9router:*:*:*:*:*:*:*:*.
Know when 9Router gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.3.75 is sufficient to resolve this issue. It is suggested to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Authentication bypass in 9Router (npm package '9router') before 0.5.6 lets a remote, unauthenticated attacker reach the
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) b
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Exploit-DB