{"id":"EUVD-2026-42931","enisaUuid":"0c108d7a-e625-389b-ab73-e2ae479939f4","description":"9Router is an AI router \u0026 token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2.","datePublished":"Jul 10, 2026, 3:38:21 PM","dateUpdated":"Jul 10, 2026, 4:46:33 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","references":"https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r\nhttps://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3\nhttps://github.com/decolua/9router/releases/tag/v0.5.2\n","aliases":"CVE-2026-55638\nGHSA-8gmq-j984-vp4r\n","assigner":"GitHub_M","epss":6.58,"enisaIdProduct":[{"id":"526c4abf-083f-38db-b2bf-88027f7d5d2c","product":{"name":"9router","vendor":{"name":"decolua"}},"product_version":"\u003c 0.5.2"}],"enisaIdVendor":[{"id":"c0397043-c4e6-3f00-85b8-943d56da7942","vendor":{"name":"decolua"}}],"enisaIdVulnerability":[{"id":"535c962e-8cd0-3a26-9c53-bfd011c72311","vulnerability":{"id":"CVE-2026-55638","description":"9Router is an AI router \u0026 token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2.","datePublished":"Jul 10, 2026, 3:38:21 PM","dateUpdated":"Jul 10, 2026, 4:46:33 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","references":"https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r\nhttps://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3\nhttps://github.com/decolua/9router/releases/tag/v0.5.2\n","enisa_id":"EUVD-2026-42931\n","assigner":"GitHub_M","epss":6.58,"dataProcessed":"Nov 7, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"7167bf7c-e77c-385d-90c2-9ebdff3a2a50","product":{"name":"9router","vendor":{"name":"decolua"}},"product_version":"\u003c 0.5.2"}],"vulnerabilityVendor":[{"id":"38ad7e2d-28fe-37c5-80aa-6db5ea434cb7","vendor":{"name":"decolua"}}]}},{"id":"87f88f7d-e6cc-30a7-b531-83334d223d05","vulnerability":{"id":"GHSA-8gmq-j984-vp4r","description":"9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass","datePublished":"Aug 28, 2026, 6:32:01 PM","dateUpdated":"Aug 28, 2026, 6:32:01 PM","baseScore":0.0,"references":"https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55638\nhttps://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3\nhttps://github.com/decolua/9router\nhttps://github.com/decolua/9router/releases/tag/v0.5.2\n","enisa_id":"EUVD-2026-42931\n","aliases":"CVE-2026-55638\nGHSA-8gmq-j984-vp4r\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}