CTT-Enhanced-CVE-2026-46339-Exploit-Engine

CTT-Enhanced-CVE-2026-46339-Exploit-Engine A specialized Python framework that executes unauthenticated remote code execution via the 9Router Model Context Protocol MCP bridge by deploying a 33-layer temporal phase cascade, Riemann-Hadamard dispersion, and an 11 ns wedge filter to bypass...

cve-2026-49352-poc

CVE-2026-49352 — Bypass de Autenticación por Secreto JWT Hardcodeado en 9router Tabla de Contenidos Resumen Versiones Afectadas Causa Raíz Análisis Estructura del Repositorio Requisitos Uso Salida Esperada Referencias Aviso Legal Resumen CVE-2026-49352 es una vulnerabilidad en 9router, un proxy...

NPM: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

NPM: 9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

EUVD-2026-63681

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-72860

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-72860

9router 's POST /api/provider-nodes/validate route is vulnerable to Server-Side Request Forgery (SSRF) due to a flaw in its assertPublicUrl guard (src/shared/utils/ssrfGuard.js). The IPv4-mapped IPv6 denylist regex is unreachable because the WHATWG URL parser canonicalizes such literals to hextet...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

PT-2026-79218

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-56677

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:10+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx 2026-08-17 23:01:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtcso2hlat27 2026-08-18...

CVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

NPM: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

NPM: 9Router: Authenticated Server-Side Request Forgery SSRF via OIDC Provider Test Endpoint vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

CVE-2026-56677

9Router 0.5.4 and earlier is vulnerable to unauthenticated SSRF: the POST /api/auth/oidc/test endpoint passes a user-supplied issuerUrl to fetchOidcDiscovery() without blocking private/loopback IPs, allowing internal service scanning and reflection of OIDC discovery fields (token_endpoint, jwks_u...

CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

EUVD-2026-60471

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belongs to a...

PT-2026-76819

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...