EUVD-2026-42931

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass...

Missing Authorization

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authorization via the rewrite process for the /codex path. An attacker can gain unauthorized access to backend LLM provider credentials and trigger upstream provider cal...

PT-2026-57219

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2 Description An authentication bypass exists because the software fails to protect the /codex endpoint in src/dashboardGuard.js before next.config.mjs rewrites /codex/ to /api/v1/responses. A remote unauthenticat...