{"id":"CVE-2026-59801","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-07-13T22:16:48.840","lastModified":"2026-10-24T22:10:00.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections."},{"lang":"es","value":"9Router a través de la versión 0.4.41 contiene una vulnerabilidad de acceso no autenticado que permite a atacantes remotos interactuar con los puntos finales de la API de gestión de proveedores enviando solicitudes sin credenciales debido a la falta de middleware de autenticación en las rutas de la API de Next.js bajo src/app/api/providers/*. Los atacantes pueden enumerar, crear, modificar o eliminar conexiones de proveedores para exponer credenciales parciales, tokens de OAuth y claves de API, redirigir el tráfico de IA a servidores controlados por el atacante, o causar una denegación de servicio completa al eliminar todas las conexiones de proveedores."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"decolua","product":"9Router","defaultStatus":"unaffected","repo":"https://github.com/decolua/9router","packageURL":"pkg:npm/9router","versions":[{"version":"0","lessThanOrEqual":"0.4.41","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-14T12:59:57.511776Z","id":"CVE-2026-59801","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/9router-unauthenticated-api-exposure-via-api-providers","source":"disclosure@vulncheck.com"},{"url":"https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}