CVE-2026-62327
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.
Risk Assessment
The risk for the organization includes unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion, potentially leading to significant financial losses and service disruptions.
Recommendation
It is recommended to immediately update 9Router to the latest version that fixes this vulnerability and to implement authentication on all sensitive API endpoints.
Original NVD description (English source)
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.