{"id":"CVE-2026-62327","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-07-13T22:16:52.403","lastModified":"2026-10-24T22:10:00.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion."},{"lang":"es","value":"9Router hasta la versión 0.4.41 contiene una vulnerabilidad de revelación de información no autenticada que permite a atacantes remotos recuperar claves API en texto plano para todas las cuentas de proveedores de IA conectadas enviando una única solicitud no autenticada al endpoint /api/usage/stats. Los atacantes pueden explotar el middleware de autenticación faltante en la ruta API de Next.js para obtener cadenas completas de claves API junto con los recuentos de tokens, desgloses de costos y metadatos de solicitud, lo que permite el uso no autorizado de cuentas de proveedores de IA conectadas, fraude de facturación y agotamiento de cuotas."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"decolua","product":"9Router","defaultStatus":"unaffected","repo":"https://github.com/decolua/9router","packageURL":"pkg:npm/9router","versions":[{"version":"0","lessThanOrEqual":"0.4.41","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-14T14:26:02.734466Z","id":"CVE-2026-62327","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats","source":"disclosure@vulncheck.com"},{"url":"https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}