9Router
CVE-2026-59801
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Missing authentication makes it network-reachable, low-complexity, no privileges or interaction (AV:N/AC:L/PR:N/UI:N); key leakage, traffic redirection, and provider deletion give full C/I/A impact within an unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.
AnalysisAI
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credentials enumerate, create, modify, and delete provider connections via the Next.js routes under src/app/api/providers/*. Because the /api/providers endpoints ship without authentication middleware, attackers can harvest partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled providers, or wipe all connections for a full denial of service; the companion /api/usage/stats endpoint further leaks full plaintext API keys. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis, though the trivial access makes exploitation straightforward.
Technical ContextAI
9Router is an AI request router/proxy distributed as the npm package 9router, fronted by a Next.js dashboard. The affected surface is the App Router API layer (src/app/api/providers/*), where route handlers execute without any authentication or session check - the root cause class is CWE-306 (Missing Authentication for a Critical Function). In Next.js App Router, each route.ts handler must independently enforce authorization; here that gate is absent entirely, so GET/POST/PUT/DELETE against provider resources are reachable by any network client. The same architectural gap extends to usage endpoints (/api/usage/stats, request-logs, request-details), which return plaintext keys and full conversation contents. The single affected CPE is cpe:2.3:a:decolua:9router:*:*:*:*:*:*:*:* (all versions up to and including 0.4.41).
RemediationAI
No vendor-released patch identified at time of analysis - the advisory GHSA-vjc7-jrh9-9j86 lists the fix as None, so upgrading is not yet an option. As compensating controls, place 9Router behind an authenticating reverse proxy or gateway that requires credentials for all /api/* routes (side effect: legitimate clients must be updated to present those credentials), and restrict network exposure so the dashboard and API bind only to localhost or a trusted management network rather than 0.0.0.0 (side effect: remote operators lose direct access and need a VPN or bastion). Specifically block or deny external access to /api/providers and /api/usage/* endpoints at the proxy layer, and because /api/usage/stats leaks plaintext keys, rotate all provider API keys, OAuth tokens, and account credentials that were configured while the instance was network-reachable. Monitor the vendor advisory (https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86) for a patched release and upgrade immediately once published.
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today