9Router
CVE-2026-62327
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network GET with no interaction (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via plaintext key leak; the endpoint itself is read-only, so I:N/A:N for this specific disclosure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.
AnalysisAI
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote attacker retrieve full plaintext API keys for every connected AI provider by issuing a single GET to the /api/usage/stats endpoint, which lacks authentication middleware. The same missing-auth flaw class extends to unauthenticated CRUD on /api/providers and exposure of full conversation histories, so an attacker can harvest credentials, hijack provider accounts, and commit billing fraud or quota exhaustion. Reported by VulnCheck with a critical CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Technical ContextAI
9Router is a Next.js-based dashboard that proxies and routes requests across multiple AI providers (e.g. OpenAI-style 'sk-...' keys, GitHub Copilot OAuth tokens, Cloudflare account IDs). The root cause is CWE-306 (Missing Authentication for Critical Function): sensitive Next.js API routes under /api/usage and /api/providers were shipped without an authentication or authorization middleware guarding them, so route handlers execute for any anonymous caller. The /api/usage/stats handler returns complete stored provider credentials in cleartext alongside token counts, cost breakdowns, and request metadata, meaning secrets that should be write-only/server-side are echoed back over an open HTTP endpoint. The affected code is identified in CPE as cpe:2.3:a:decolua:9router and distributed via npm as package '9router'.
RemediationAI
No vendor-released patch identified at time of analysis (advisory states 'fixed in: None'), so upgrading is not currently an option; monitor the GitHub advisory GHSA-vjc7-jrh9-9j86 (https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86) and the VulnCheck advisory (https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats) for a fixed version. As compensating controls: block all external network access to the 9Router dashboard and place it behind an authenticating reverse proxy or VPN so /api/usage/stats, /api/providers, and /api/usage/request-* are never anonymously reachable (trade-off: breaks any legitimate direct API clients that lack proxy credentials); at minimum restrict the /api/* routes to trusted source IPs at the load balancer. Because full plaintext keys have likely already been exposed if the instance was internet-facing, immediately rotate/revoke every connected AI provider API key and OAuth token and audit provider billing for unauthorized usage. If self-patching, add an authentication middleware check to the affected Next.js API route handlers before further exposure.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today