CVE-2026-49352

🗓️ 15 Jul 2026 20:43:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 50 Views🌐 WEB

Nine Router hardcoded fallback secret allowed auth_token forged, bypassing auth; fixed in version 0.4.44.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-49352	15 Jul 202620:43	–	attackerkb
Circl	CVE-2026-49352	2 Jul 202622:35	–	circl
Cvelist	CVE-2026-49352 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass	15 Jul 202620:43	–	cvelist
EUVD	EUVD-2026-44809	15 Jul 202620:43	–	euvd
GithubExploit	Exploit for CVE-2026-49352	6 Jul 202612:37	–	githubexploit
Github Security Blog	9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass	2 Jul 202620:56	–	github
GitLab Advisory Database	9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass	2 Jul 202600:00	–	gitlab
NVD	CVE-2026-49352	15 Jul 202621:16	–	nvd
OSV	CVE-2026-49352 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass	15 Jul 202620:43	–	osv
OSV	GHSA-JPHH-M39H-6GWX 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass	2 Jul 202620:56	–	osv

Vulners

Node

decolua 9routerRange0.2.21–0.4.44

[
  {
    "vendor": "decolua",
    "product": "9router",
    "versions": [
      {
        "version": ">= 0.2.21, < 0.4.44",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/decolua/9router/commit/fe3ce25ae3cda48c0702c2d452e17f6ec214009d
github	www.github.com/decolua/9router/releases/tag/v0.4.44
github	www.github.com/decolua/9router/security/advisories/GHSA-jphh-m39h-6gwx

Parameter	Position	Path	Description	CWE
auth_token	header	/dashboard	Authentication bypass via forged JWT using hardcoded fallback secret allows access to dashboard.	CWE-798
auth_token	header	/api/settings/database	Exposed credentials endpoint accessible with forged token due to bypass.	CWE-798

16 Jul 2026 19:16Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19.8

EPSS0.00601

SSVC

CWE-798