CVE-2026-55501
HighCVSS 7.3Summary
In 9Router prior to version 0.4.80, the dashboard login rate limiter relies on the attacker-controlled X-Forwarded-For HTTP header. This allows bypassing the 5-attempt threshold and progressive lockout durations by rotating the header value on each login attempt.
Risk Assessment
An attacker can perform unlimited brute-force attempts against the dashboard password, potentially gaining full control over the AI router, leading to data leakage or traffic manipulation.
Recommendation
Upgrade 9Router to version 0.4.80 or later immediately. If upgrading is not possible, restrict dashboard access to trusted networks or enable multi-factor authentication.
Other vulnerabilities in 9Router
See all- CVE-2026-56675High
9Router before version 0.5.2 treats loopback requests as trusted and allows /v1/* access without an API key. A same-host reverse proxy forwarding public traffic through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local, enabling a remote unauthenticated attacker to access /v1 APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints.
- CVE-2026-55638High
9Router before version 0.5.2 fails to protect the /codex path, allowing a remote unauthenticated attacker to bypass the API-key gate and send requests to /codex/*, which are rewritten to /api/v1/responses. The attacker can exploit this to make upstream provider calls using operator-stored LLM credentials.
- CVE-2026-63732Critical
9router 0.4.59 contains a chain of vulnerabilities: a hardcoded default password (123456), a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin to achieve arbitrary code execution on the host operating system.
- CVE-2026-49352Critical
In 9Router versions 0.2.21 through 0.4.44, a hardcoded fallback JWT secret '9router-default-secret-change-me' was used, allowing attackers to forge an auth_token cookie when JWT_SECRET is unset. The issue is fixed in version 0.4.44.
- CVE-2026-46339Critical
In 9Router versions 0.4.30 through 0.4.37, the middleware in src/proxy.js did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated plugin registration and command execution via the MCP bridge. This vulnerability is fixed in version 0.4.37.
- CVE-2026-62327Critical
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.
- CVE-2026-59801Critical
9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.
- CVE-2026-55500Critical
In 9Router prior to version 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.
- CVE-2026-59800Critical
9Router before version 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint. The sudoPassword field from the request body is passed to the stdin of a 'sudo -S sh' process, allowing a remote unauthenticated attacker to execute arbitrary OS commands.
- CVE-2026-72860High
An SSRF vulnerability in the POST /api/provider-nodes/validate route in 9router allows an attacker to make server-side requests to internal addresses, including loopback and link-local, due to flaws in the assertPublicUrl guard. Additionally, internal responses may be disclosed, and the API key is forwarded to internal destinations.
Original NVD description (English source)
9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.