CVE-2026-56675

Katalog CVE

CVSS 8.3 · High EPSS 0,50%

Kerentanan Improper Authentication. Skor CVSS 3.1 8.3 (High) menurut github.com.

Deskripsi (NVD)

9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

10 Juli 2026

Status NVD

Deferred

CVSS 3.1

8.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-290: Authentication Bypass by Spoofing
CWE-306: Missing Authentication for Critical Function
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc
• https://github.com/decolua/9router/releases/tag/v0.5.2
• https://github.com/decolua/9router/security/advisories/GHSA-x5c9-v98j-722r