CVE-2026-56681

🗓️ 22 Sep 2026 16:02:25Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Unauthenticated auth bypass in 9Router via X-9r-Real-Ip header enabling free LLM API access.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-56681	22 Sep 202618:32	–	circl
Cvelist	CVE-2026-56681 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header	22 Sep 202616:02	–	cvelist
EUVD	EUVD-2026-84541	22 Sep 202616:02	–	euvd
Github Security Blog	9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header	22 Sep 202616:34	–	github
GitLab Advisory Database	9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header	22 Sep 202600:00	–	gitlab
Nuclei	9router <=0.5.4 - Authentication Bypass	24 Sep 202606:33	–	nuclei
NVD	CVE-2026-56681	22 Sep 202616:17	–	nvd
OSV	GHSA-5MJ8-GF6M-FHW8 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header	22 Sep 202616:34	–	osv
Patchstack	NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header	22 Sep 202616:34	–	patchstack
Rapid7 Vulnerability Database (full)	CVE-2026-56681: Reliance on Untrusted Inputs in a Security Decision	22 Sep 202600:00	–	rapid7

[
  {
    "vendor": "decolua",
    "product": "9router",
    "versions": [
      {
        "version": "< 0.5.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3
github	www.github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8
github	www.github.com/decolua/9router/releases/tag/v0.5.6

Parameter	Position	Path	Description	CWE
X-9r-Real-Ip	header	/api/v1/models	Header-based spoofing of local-ness via X-9r-Real-Ip allows bypass of API-key validation for GET /api/v1/models by classifying the client as local.	CWE-807
X-9r-Real-Ip	path	/api/v1/*	Any /api/v1/* endpoints are vulnerable when the X-9r-Real-Ip header can be used to classify requests as local, potentially bypassing API-key validation.	CWE-807

22 Sep 2026 16:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.3

EPSS0.00475

CWE-807