{"id":"EUVD-2026-42926","enisaUuid":"b61bf5b4-f7b9-37a0-a1b3-443429c47825","description":"9Router is an AI router \u0026 token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.","datePublished":"Jul 10, 2026, 3:23:53 PM","dateUpdated":"Jul 10, 2026, 4:45:23 PM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7\nhttps://github.com/decolua/9router/commit/7648c3412b403a29f04967c4b4e9725e228791d4\nhttps://github.com/decolua/9router/releases/tag/v0.4.80\n","aliases":"CVE-2026-55501\nGHSA-7cfm-pqrj-xgq7\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"85ce8d05-223d-35cf-a38f-a0e077e0776e","product":{"name":"9router","vendor":{"name":"decolua"}},"product_version":"\u003c 0.4.80"}],"enisaIdVendor":[{"id":"0c2f6162-f852-36d1-8e78-9c19957793b9","vendor":{"name":"decolua"}}],"enisaIdVulnerability":[{"id":"38f4f5ec-7128-3678-8387-abf8a80f0426","vulnerability":{"id":"CVE-2026-55501","description":"9Router is an AI router \u0026 token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.","datePublished":"Jul 10, 2026, 3:23:53 PM","dateUpdated":"Jul 10, 2026, 4:45:23 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7\nhttps://github.com/decolua/9router/commit/7648c3412b403a29f04967c4b4e9725e228791d4\nhttps://github.com/decolua/9router/releases/tag/v0.4.80\n","enisa_id":"EUVD-2026-42926\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"03ccf508-549f-32fa-acf0-2acb1570220f","product":{"name":"9router","vendor":{"name":"decolua"}},"product_version":"\u003c 0.4.80"}],"vulnerabilityVendor":[{"id":"82090332-e6ff-32ac-b16d-bca918205a46","vendor":{"name":"decolua"}}]}},{"id":"bec72655-1771-3096-acfb-66ae6e7a7fdd","vulnerability":{"id":"GHSA-7cfm-pqrj-xgq7","description":"9router: Login brute-force protection bypass via spoofed X-Forwarded-For header","datePublished":"Jul 6, 2026, 9:46:20 PM","dateUpdated":"Jul 6, 2026, 9:46:20 PM","baseScore":0.0,"references":"https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7\nhttps://github.com/decolua/9router\n","enisa_id":"EUVD-2026-42926\n","aliases":"GHSA-7cfm-pqrj-xgq7\nCVE-2026-55501\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}