CVE

CVE-2026-56681

7.3

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

9router

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation. References: https://github.com/advisories/GHSA-5mj8-gf6m-fhw8 https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8 https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3 https://github.com/decolua/9router/releases/tag/v0.5.6 Remediation: Update to version 0.5.6 or later.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: 9router

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →