EUVD-2026-60471
GHSA-8g4w-4ffg-8vgx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
SSRF yields internal service enumeration (C:L); no direct data modification or availability impact is described, so I and A are N; PR:N reflects the unauthenticated condition when dashboard login is disabled.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.
AnalysisAI
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe internal network services by supplying an arbitrary issuerUrl to the /api/auth/oidc/test endpoint, which the application fetches without validating against private or loopback address ranges. The reflected OIDC discovery fields - including token_endpoint and jwks_uri - expose internal service metadata, enabling internal network enumeration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that 9Router's dashboard login feature is explicitly disabled - this is the stated precondition and the basis for CWE-306 classification; when dashboard authentication is enabled, the endpoint is not accessible to unauthenticated callers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) yields a score of 8.6, but the I:H metric warrants scrutiny - the described behavior is SSRF with information reflection, not direct data modification. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an unauthenticated 9Router instance sends a POST request to /api/auth/oidc/test with an issuerUrl set to an internal address such as http://192.168.1.10:8080. The server fetches http://192.168.1.10:8080/.well-known/openid-configuration and returns the response body, allowing the attacker to confirm whether the internal host is live and extract any OIDC metadata fields it exposes. … |
| Remediation | Consult the vendor advisory at https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx for an official patched release; no exact fix version is confirmed in the available intelligence, so monitor the decolua/9router repository for a release beyond 0.5.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, implement network-level access controls to restrict the /api/auth/oidc/test endpoint to authenticated users only, using WAF rules or network ACLs to block external probing attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credential
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded de
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access t
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the h
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read ev
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable applicatio
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protect
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach p
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: lo
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-prox
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today