CVE

CVE-2026-59801

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

9router

Updated Nov 10, 2026View on NVD →

S4E scanner

highMisconfiguration~10 seconds

9Router - Unauthenticated LLM Provider API Exposure

9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication. References: https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 https://nvd.nist.gov/vuln/detail/CVE-2026-59801 Remediation: Update to the latest version that includes authentication middleware for API routes.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: 9router

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →