9Router
CVE-2026-62328
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Endpoints are network-reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); this CVE covers only unauthenticated data disclosure, so C:H with I:N/A:N despite the advisory's broader CRUD impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.
AnalysisAI
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read every user's AI request logs and full conversation histories by querying the /api/usage/request-logs and /api/usage/request-details endpoints, which ship without authentication middleware. Exposed data includes system prompts, user and assistant messages, tool calls, and user email addresses, and the linked GHSA advisory shows the same missing-auth flaw class also leaks plaintext provider API keys via /api/usage/stats and permits unauthenticated CRUD on /api/providers. This is a network-reachable, no-privilege flaw (CVSS 4.0 8.7) with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Technical ContextAI
9Router is a Next.js dashboard/proxy that routes requests to multiple AI providers (e.g., OpenAI-style keys, GitHub Copilot OAuth, Cloudflare accounts) and records per-request usage. The root cause is CWE-862 Missing Authorization: the App Router API routes under /api/usage/* (and, per the GHSA advisory, /api/providers/*) never enforce an authentication or session check, so any anonymous HTTP client can reach handlers that were presumably intended for an authenticated dashboard operator. Because these endpoints return persisted request logs and conversation transcripts, the missing middleware turns internal audit/telemetry data into a public read surface, and the paginated request-logs route lets an attacker walk the entire dataset rather than a single record. The affected package is identified by CPE cpe:2.3:a:decolua:9router:*:*:*:*:*:*:*:* and npm package 9router.
RemediationAI
No vendor-released patch identified at time of analysis - the GHSA advisory records the fixed version as None, so an upgrade target cannot be cited. As specific compensating controls, place 9Router behind an authenticating reverse proxy or SSO/mTLS gateway and require authentication for all /api/* routes, since the application itself enforces none; at minimum block or deny external access to /api/usage/request-logs, /api/usage/request-details, /api/usage/stats, and /api/providers (all methods) at the proxy or firewall, accepting that this will break any legitimate remote dashboard/API use of those routes until an authenticated front end is added. Restrict the dashboard to localhost or a trusted management VLAN and do not expose it to the internet. Because /api/usage/stats can leak plaintext provider API keys and /api/providers can be modified by anyone, treat any keys and OAuth/account credentials configured on an exposed instance as compromised and rotate them (OpenAI-style API keys, GitHub Copilot OAuth tokens, Cloudflare account credentials). Monitor the GHSA advisory (https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86) for a patched release and upgrade as soon as one is published.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today