EUVD-2026-33685
GHSA-rj93-2986-gmf9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.
AnalysisAI
Improper authorization in decolua 9router through version 0.4.0 allows remote attackers with low privileges to bypass JWT authentication by manipulating the HTTP Host header, gaining unauthorized access to protected dashboard and API endpoints. The vulnerable isLocalRequest() function in dashboardGuard.js blindly trusted the client-supplied Host header to determine whether a request originated from localhost, enabling any network-reachable attacker to spoof local origin by sending Host: localhost. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patch v0.4.1 is available and confirmed.
Technical ContextAI
The affected component is dashboardGuard.js within decolua 9router (CPE: cpe:2.3:a:decolua:9router:*:*:*:*:*:*:*:*), a JavaScript-based HTTP routing application. The root cause is CWE-285 (Improper Authorization): the now-removed isLocalRequest() function extracted a hostname from the client-controlled HTTP Host header and compared it against the strings localhost, 127.0.0.1, and ::1. Because HTTP clients set arbitrary Host values, this locality check offered no security guarantee - it was a trust boundary violation, not a real network origin check. The isAuthenticated() function used this result to bypass JWT validation for certain always-protected and requireLogin-gated endpoint categories. The fix in commit 428e2c0 eliminates isLocalRequest() entirely and introduces a machine-ID-derived HMAC token transmitted via the x-9r-cli-token header, which cannot be forged by remote clients without knowledge of the server's machine ID and the CLI_TOKEN_SALT constant.
RemediationAI
Upgrade decolua 9router to version 0.4.1 immediately; this is the vendor-confirmed fix available at https://github.com/decolua/9router/releases/tag/v0.4.1 with patch details at https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. If immediate upgrade is not feasible, restrict network access to the 9router HTTP interface via firewall rules or reverse proxy ACLs so that only trusted IP ranges can reach the service port - note this is a compensating control only and does not fix the underlying trust issue in the application code. Do not attempt to mitigate this vulnerability by blocking specific Host header values at a WAF or proxy layer alone, as the control surface is large and bypass variants are trivial. Avoid relying on network-level localhost binding as a security boundary unless the 9router process is confirmed to accept connections exclusively on 127.0.0.1 with no reverse proxy forwarding external requests.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe interna
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today