93 matches found
9router <=0.5.4 - Authentication Bypass
9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...
CTT-Enhanced-CVE-2026-46339-Exploit-Engine
CTT-Enhanced-CVE-2026-46339-Exploit-Engine Un framework especializado en Python que ejecuta ejecución remota de código no autenticada a través del puente del Model Context Protocol MCP de 9Router, implementando una cascada de fases temporales de 33 capas, dispersión de Riemann-Hadamard y un filtr...
CVE-2026-103530
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...
CVE-2026-103530
The decolua 9Router software (up to version 0.5.55 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the fetch function of the src/shared/utils/ssrfGuard.js file, specifically located in the Search Endpoint component. An attacker can initiate this attack remotely by...
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...
cve-2026-49352-poc
CVE-2026-49352 — Bypass de Autenticación por Secreto JWT Hardcodeado en 9router Tabla de Contenidos Resumen Versiones Afectadas Causa Raíz Análisis Estructura del Repositorio Requisitos Uso Salida Esperada Referencias Aviso Legal Resumen CVE-2026-49352 es una vulnerabilidad en 9router, un proxy...
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
Summary The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the...
9router: Image prefetch DNS rebinding allows SSRF to internal services
Summary 9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allo...
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
Summary 9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows...
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed...
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows unauthenticated...
9router: Image prefetch DNS rebinding allows SSRF to internal services
9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the...
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for the who...
CVE-2026-56681
creationtimestamp| type| source ---|---|--- 2026-09-22 18:32:29+00:00| seen| https://gist.github.com/alon710/bf3a865551bb5c97cbf5b48608ac9014 2026-09-22 18:35:06+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8 2026-09-23 02:58:05+00:00...
CVE-2026-56682
creationtimestamp| type| source ---|---|--- 2026-09-22 17:31:57+00:00| seen| https://gist.github.com/alon710/cfe610105c4dec5cb69ce6f35d82ab7c 2026-09-22 18:35:02+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v...
CVE-2026-56682
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js fo...
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Summary 9router enforces a progressive login lockout 5 failed attempts → temporary 30s+ lock keyed on the client IP. The client IP used for this limiter is taken from the X-9r-Real-Ip request header, which is intended to be set only by the bundled custom-server.js layer from the unspoofable TCP...