CVE-2026-49353

9Router before version 0.5.2 treats loopback requests as trusted and allows /v1/* access without an API key. A same-host reverse proxy forwarding public traffic through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local, enabling a remote unauthenticated attacker to access /v1 APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints.

9Router before version 0.5.2 fails to protect the /codex path, allowing a remote unauthenticated attacker to bypass the API-key gate and send requests to /codex/*, which are rewritten to /api/v1/responses. The attacker can exploit this to make upstream provider calls using operator-stored LLM credentials.

In 9Router prior to version 0.4.80, the dashboard login rate limiter relies on the attacker-controlled X-Forwarded-For HTTP header. This allows bypassing the 5-attempt threshold and progressive lockout durations by rotating the header value on each login attempt.

9router 0.4.59 contains a chain of vulnerabilities: a hardcoded default password (123456), a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin to achieve arbitrary code execution on the host operating system.

In 9Router versions 0.2.21 through 0.4.44, a hardcoded fallback JWT secret '9router-default-secret-change-me' was used, allowing attackers to forge an auth_token cookie when JWT_SECRET is unset. The issue is fixed in version 0.4.44.

In 9Router versions 0.4.30 through 0.4.37, the middleware in src/proxy.js did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated plugin registration and command execution via the MCP bridge. This vulnerability is fixed in version 0.4.37.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.

9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.

In 9Router prior to version 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

9Router before version 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint. The sudoPassword field from the request body is passed to the stdin of a 'sudo -S sh' process, allowing a remote unauthenticated attacker to execute arbitrary OS commands.