9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

🗓️ 02 Jul 2026 21:13:19Reported by GitHub Advisory DatabaseType

Incomplete fix for CVE-2026-46339: gate uses Host and Origin headers, bypassable behind proxies.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-46339	13 May 202613:15	–	circl
CVE	CVE-2026-46339	19 May 202619:22	–	cve
CVE	CVE-2026-49353	2 Jul 202600:00	–	cve
Github Security Blog	9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202619:22	–	github
Github Security Blog	9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass	2 Jul 202620:56	–	github
GitLab Advisory Database	9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING	2 Jul 202600:00	–	gitlab
GitLab Advisory Database	9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202600:00	–	gitlab
OSV	GHSA-6G2F-W7G3-77VF 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING	2 Jul 202621:13	–	osv
OSV	GHSA-FHH6-4QXV-RPQJ 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202619:22	–	osv
Patchstack	NPM: 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202619:22	–	patchstack

Vulners

Node

9routerRange≤0.4.55npm

Source	Link
github	www.github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf
github	www.github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db
github	www.github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5
github	www.github.com/advisories/GHSA-6g2f-w7g3-77vf

02 Jul 2026 21:13Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.00147