9Router
Monthly
Server-side request forgery in decolua 9router ≤ 0.5.55 allows session-authenticated users (or unauthenticated callers when requireLogin is disabled) to reach internal network resources via the POST /api/provider-nodes/validate endpoint. The SSRF guard's IPv4-mapped IPv6 branch is structurally unreachable: WHATWG URL canonicalization rewrites dotted-quad notation to hextet form before the string regex is evaluated, so addresses such as http://[::ffff:7f00:1] (loopback) and http://[::ffff:a9fe:a9fe] (cloud metadata) pass unchecked. No public exploit has been identified at time of analysis, though the root cause and bypass technique are fully documented in the public GitHub issue and fix PR.
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe internal network services by supplying an arbitrary issuerUrl to the /api/auth/oidc/test endpoint, which the application fetches without validating against private or loopback address ranges. The reflected OIDC discovery fields - including token_endpoint and jwks_uri - expose internal service metadata, enabling internal network enumeration. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes opportunistic scanning plausible.
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded default password (123456) accepted on any fresh install, a Host-header spoof that defeats the LOCAL_ONLY network gate, and unsanitized arguments reaching child_process.spawn() during MCP plugin registration - to run arbitrary OS commands on the host. The issue is fixed in 0.4.60, was reported by VulnCheck, and carries a CVSS 4.0 base score of 9.4; no public exploit identified at time of analysis, though the advisory describes a directly reproducible attack path.
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v1/web/fetch endpoint to make the server retrieve arbitrary internal URLs and return their content. Because the user-supplied url is only checked for syntactic validity via new URL() before being handed to an external scraping provider, an attacker can reach cloud metadata endpoints (169.254.169.254), link-local/private addresses, and localhost-only services, harvesting credentials and bypassing host-based auth. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.3 reflects high confidentiality impact with a scope/subsequent-system change.
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the host by chaining a Host-header spoof (to reach routes that are supposed to be localhost-only) with unsanitized MCP plugin arguments that flow into child_process.spawn() via the /api/mcp//sse endpoint. Rated CVSS 8.8 (CWE-78, OS command injection), it is fixed in 0.5.2; no public exploit or CISA KEV listing exists at time of analysis, though a vendor advisory and fix commit are published.
Server-side request forgery (SSRF) in 9Router's Kiro API-key validation endpoint allows authenticated attackers to redirect outbound validation requests to an attacker-controlled host, exfiltrating the submitted Kiro API key via the Authorization header. Affected are all 9Router deployments prior to version 0.5.6 where the Kiro OAuth provider is configured. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack is low-complexity once authenticated. Vendor-released patch is available in v0.5.6.
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable application-wide login by abusing a mass-assignment flaw in the PATCH /api/settings endpoint. Because the endpoint persists the entire request body without a field whitelist, a low-privileged user can flip security-critical settings such as requireLogin, thereby exposing sensitive routes like /api/keys and /api/providers to unauthenticated access. No public exploit identified at time of analysis; the issue is fixed in version 0.5.4.
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read every user's AI request logs and full conversation histories by querying the /api/usage/request-logs and /api/usage/request-details endpoints, which ship without authentication middleware. Exposed data includes system prompts, user and assistant messages, tool calls, and user email addresses, and the linked GHSA advisory shows the same missing-auth flaw class also leaks plaintext provider API keys via /api/usage/stats and permits unauthenticated CRUD on /api/providers. This is a network-reachable, no-privilege flaw (CVSS 4.0 8.7) with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote attacker retrieve full plaintext API keys for every connected AI provider by issuing a single GET to the /api/usage/stats endpoint, which lacks authentication middleware. The same missing-auth flaw class extends to unauthenticated CRUD on /api/providers and exposure of full conversation histories, so an attacker can harvest credentials, hijack provider accounts, and commit billing fraud or quota exhaustion. Reported by VulnCheck with a critical CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credentials enumerate, create, modify, and delete provider connections via the Next.js routes under src/app/api/providers/*. Because the /api/providers endpoints ship without authentication middleware, attackers can harvest partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled providers, or wipe all connections for a full denial of service; the companion /api/usage/stats endpoint further leaks full plaintext API keys. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis, though the trivial access makes exploitation straightforward.
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach protected /v1/* proxy APIs because src/dashboardGuard.js trusts any request arriving over loopback. When 9Router runs behind a same-host reverse proxy that forwards public traffic through 127.0.0.1 - the standard production deployment - external requests are misclassified as local, exposing /v1/models and enabling abuse of configured upstream AI provider credentials. No public exploit identified at time of analysis; scored CVSS 8.3 with a scope change reflecting downstream provider-credential abuse.
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protected upstream LLM functionality through the /codex/* path, which next.config.mjs rewrites to /api/v1/responses without ever passing through the dashboardGuard API-key check. Because src/dashboardGuard.js only allowlists /v1, /v1beta, /api/v1, and /api/v1beta — omitting /codex — attackers can force the server to make upstream provider calls billed to operator-stored LLM credentials. No public exploit identified at time of analysis; fixed in 0.5.2.
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: localhost' header so the /v1 LLM proxy treats the request as local and skips API-key checks. Once past authentication, an attacker abuses stored provider credentials for upstream LLM calls and leverages /v1/search's searxng provider_options.baseUrl to force server-side requests to internal or cloud-metadata endpoints (SSRF). No public exploit identified at time of analysis, though the fixing commit is public, and EPSS/KEV signals are not provided.
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-proxy user to reach internal-only HTTP services. The image-URL validation resolves the host once to a public IP, but open-sse/translator/concerns/image.js performs the actual server-side fetch with a separate DNS lookup, so an attacker-controlled name can rebind to an internal address between the two resolutions. No public exploit identified at time of analysis; the flaw is fixed in 0.5.2.
Improper authorization in decolua 9router through version 0.4.0 allows remote attackers with low privileges to bypass JWT authentication by manipulating the HTTP Host header, gaining unauthorized access to protected dashboard and API endpoints. The vulnerable isLocalRequest() function in dashboardGuard.js blindly trusted the client-supplied Host header to determine whether a request originated from localhost, enabling any network-reachable attacker to spoof local origin by sending Host: localhost. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patch v0.4.1 is available and confirmed.
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access the Administrative API Endpoint (/api) without proper credentials, potentially exposing sensitive functionality. The vulnerability has publicly available exploit code and vendor-released patch version 0.3.75 is available, reducing real-world risk for patched deployments but creating urgency for unpatched instances given active public disclosures.
Server-side request forgery in decolua 9router ≤ 0.5.55 allows session-authenticated users (or unauthenticated callers when requireLogin is disabled) to reach internal network resources via the POST /api/provider-nodes/validate endpoint. The SSRF guard's IPv4-mapped IPv6 branch is structurally unreachable: WHATWG URL canonicalization rewrites dotted-quad notation to hextet form before the string regex is evaluated, so addresses such as http://[::ffff:7f00:1] (loopback) and http://[::ffff:a9fe:a9fe] (cloud metadata) pass unchecked. No public exploit has been identified at time of analysis, though the root cause and bypass technique are fully documented in the public GitHub issue and fix PR.
Server-Side Request Forgery (SSRF) in 9Router 0.5.4 and earlier allows unauthenticated remote attackers to probe internal network services by supplying an arbitrary issuerUrl to the /api/auth/oidc/test endpoint, which the application fetches without validating against private or loopback address ranges. The reflected OIDC discovery fields - including token_endpoint and jwks_uri - expose internal service metadata, enabling internal network enumeration. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes opportunistic scanning plausible.
Remote unauthenticated code execution in 9router 0.4.59 (by decolua) lets an attacker chain three flaws - a hardcoded default password (123456) accepted on any fresh install, a Host-header spoof that defeats the LOCAL_ONLY network gate, and unsanitized arguments reaching child_process.spawn() during MCP plugin registration - to run arbitrary OS commands on the host. The issue is fixed in 0.4.60, was reported by VulnCheck, and carries a CVSS 4.0 base score of 9.4; no public exploit identified at time of analysis, though the advisory describes a directly reproducible attack path.
Server-side request forgery in 9Router before 0.4.72 lets an authenticated (PR:L) or locally-connected user abuse the /v1/web/fetch endpoint to make the server retrieve arbitrary internal URLs and return their content. Because the user-supplied url is only checked for syntactic validity via new URL() before being handed to an external scraping provider, an attacker can reach cloud metadata endpoints (169.254.169.254), link-local/private addresses, and localhost-only services, harvesting credentials and bypassing host-based auth. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.3 reflects high confidentiality impact with a scope/subsequent-system change.
Authenticated remote code execution in 9Router before 0.5.2 lets a logged-in attacker run arbitrary OS commands on the host by chaining a Host-header spoof (to reach routes that are supposed to be localhost-only) with unsanitized MCP plugin arguments that flow into child_process.spawn() via the /api/mcp//sse endpoint. Rated CVSS 8.8 (CWE-78, OS command injection), it is fixed in 0.5.2; no public exploit or CISA KEV listing exists at time of analysis, though a vendor advisory and fix commit are published.
Server-side request forgery (SSRF) in 9Router's Kiro API-key validation endpoint allows authenticated attackers to redirect outbound validation requests to an attacker-controlled host, exfiltrating the submitted Kiro API key via the Authorization header. Affected are all 9Router deployments prior to version 0.5.6 where the Kiro OAuth provider is configured. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack is low-complexity once authenticated. Vendor-released patch is available in v0.5.6.
Authentication bypass in 9Router (AI router & token saver) prior to 0.5.4 lets any authenticated user disable application-wide login by abusing a mass-assignment flaw in the PATCH /api/settings endpoint. Because the endpoint persists the entire request body without a field whitelist, a low-privileged user can flip security-critical settings such as requireLogin, thereby exposing sensitive routes like /api/keys and /api/providers to unauthenticated access. No public exploit identified at time of analysis; the issue is fixed in version 0.5.4.
Unauthenticated information disclosure in 9Router (decolua/9router) through version 0.4.41 lets remote attackers read every user's AI request logs and full conversation histories by querying the /api/usage/request-logs and /api/usage/request-details endpoints, which ship without authentication middleware. Exposed data includes system prompts, user and assistant messages, tool calls, and user email addresses, and the linked GHSA advisory shows the same missing-auth flaw class also leaks plaintext provider API keys via /api/usage/stats and permits unauthenticated CRUD on /api/providers. This is a network-reachable, no-privilege flaw (CVSS 4.0 8.7) with no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Unauthenticated API key disclosure in 9Router (npm package '9router' by decolua) through version 0.4.41 lets any remote attacker retrieve full plaintext API keys for every connected AI provider by issuing a single GET to the /api/usage/stats endpoint, which lacks authentication middleware. The same missing-auth flaw class extends to unauthenticated CRUD on /api/providers and exposure of full conversation histories, so an attacker can harvest credentials, hijack provider accounts, and commit billing fraud or quota exhaustion. Reported by VulnCheck with a critical CVSS 4.0 base of 9.3; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
Unauthenticated CRUD on the provider-management API in 9Router (through 0.4.41) lets remote attackers with no credentials enumerate, create, modify, and delete provider connections via the Next.js routes under src/app/api/providers/*. Because the /api/providers endpoints ship without authentication middleware, attackers can harvest partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled providers, or wipe all connections for a full denial of service; the companion /api/usage/stats endpoint further leaks full plaintext API keys. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis, though the trivial access makes exploitation straightforward.
Authentication bypass in 9Router (decolua/9router) versions prior to 0.5.2 lets remote unauthenticated attackers reach protected /v1/* proxy APIs because src/dashboardGuard.js trusts any request arriving over loopback. When 9Router runs behind a same-host reverse proxy that forwards public traffic through 127.0.0.1 - the standard production deployment - external requests are misclassified as local, exposing /v1/models and enabling abuse of configured upstream AI provider credentials. No public exploit identified at time of analysis; scored CVSS 8.3 with a scope change reflecting downstream provider-credential abuse.
Authorization-gate bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker reach protected upstream LLM functionality through the /codex/* path, which next.config.mjs rewrites to /api/v1/responses without ever passing through the dashboardGuard API-key check. Because src/dashboardGuard.js only allowlists /v1, /v1beta, /api/v1, and /api/v1beta — omitting /codex — attackers can force the server to make upstream provider calls billed to operator-stored LLM credentials. No public exploit identified at time of analysis; fixed in 0.5.2.
Authentication bypass in 9Router (decolua/9router) before 0.5.2 lets a remote unauthenticated attacker forge a 'Host: localhost' header so the /v1 LLM proxy treats the request as local and skips API-key checks. Once past authentication, an attacker abuses stored provider credentials for upstream LLM calls and leverages /v1/search's searxng provider_options.baseUrl to force server-side requests to internal or cloud-metadata endpoints (SSRF). No public exploit identified at time of analysis, though the fixing commit is public, and EPSS/KEV signals are not provided.
Server-side request forgery via DNS rebinding in 9Router (decolua/9router) before 0.5.2 allows an authenticated LLM-proxy user to reach internal-only HTTP services. The image-URL validation resolves the host once to a public IP, but open-sse/translator/concerns/image.js performs the actual server-side fetch with a separate DNS lookup, so an attacker-controlled name can rebind to an internal address between the two resolutions. No public exploit identified at time of analysis; the flaw is fixed in 0.5.2.
Improper authorization in decolua 9router through version 0.4.0 allows remote attackers with low privileges to bypass JWT authentication by manipulating the HTTP Host header, gaining unauthorized access to protected dashboard and API endpoints. The vulnerable isLocalRequest() function in dashboardGuard.js blindly trusted the client-supplied Host header to determine whether a request originated from localhost, enabling any network-reachable attacker to spoof local origin by sending Host: localhost. No public exploit code or CISA KEV listing exists at time of analysis; vendor-released patch v0.4.1 is available and confirmed.
Remote authorization bypass in decolua 9router up to version 0.3.47 allows unauthenticated network attackers to access the Administrative API Endpoint (/api) without proper credentials, potentially exposing sensitive functionality. The vulnerability has publicly available exploit code and vendor-released patch version 0.3.75 is available, reducing real-world risk for patched deployments but creating urgency for unpatched instances given active public disclosures.