{"id":"EUVD-2026-84541","revision":null,"records":[{"revision":"7b1c666d08a64cf6ba6397ccb0374043","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-56681","aliases":[],"title":"9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header","description":"9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.","state":0,"publishedAt":"2026-09-22T16:02:25.018+00:00","modifiedAt":"2026-09-28T19:31:54.707+00:00","affected":[{"ecosystem":"Vendor product","name":"9router","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"decolua\",\n                    \"product\": \"9router\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.5.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3,"severity":"HIGH"}],"references":["https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8","https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3","https://github.com/decolua/9router/releases/tag/v0.5.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-56681","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-56681","identifiers":["CVE-2026-56681"]},"retained":false,"historicalAffected":[]},{"revision":"f10ddd46f45c4d70bb13361167eb168f","observedAt":"2026-11-11T14:06:58.927+00:00","statement":{"source":"euvd","id":"EUVD-2026-84541","aliases":["CVE-2026-56681","GHSA-5mj8-gf6m-fhw8"],"title":"9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLo…","description":"9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3,"severity":null}],"references":["https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8","https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3","https://github.com/decolua/9router/releases/tag/v0.5.6"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84541","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2026, 4:02:25 PM","dateUpdated":"Sep 28, 2026, 7:31:54 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84541","identifiers":["EUVD-2026-84541","CVE-2026-56681","GHSA-5mj8-gf6m-fhw8"]},"retained":false,"historicalAffected":[]},{"revision":"6653f1d8aa294e4b8c7fd15da7997577","observedAt":"2026-10-25T14:19:10.848+00:00","statement":{"source":"nvd","id":"CVE-2026-56681","aliases":[],"title":"9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLo…","description":"9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.","state":0,"publishedAt":"2026-09-22T16:17:48.35+00:00","modifiedAt":"2026-09-28T20:17:10.54+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3,"severity":"HIGH"}],"references":["https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3","https://github.com/decolua/9router/releases/tag/v0.5.6","https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56681","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-807"],"productCriteria":[],"sourceDates":{"published":"2026-09-22T16:17:48.350","lastModified":"2026-09-28T20:17:10.540"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-56681","identifiers":["CVE-2026-56681"]},"retained":false,"historicalAffected":[]},{"revision":"dba6fb8fd79643139b8408cd8fb84586","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-5mj8-gf6m-fhw8","aliases":["CVE-2026-56681"],"title":"9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header","description":"## Summary\n\n9router determines whether an incoming request originates from localhost by trusting the X-9r-Real-Ip HTTP request header. This header is intended to be produced and sanitized exclusively by the bundled custom-server.js layer from the TCP socket address. In deployment modes where requests reach Next.js directly (the header is never stripped/regenerated), a remote, unauthenticated attacker can simply send X-9r-Real-Ip: 127.0.0.1 and be treated as a local client. This bypasses the API-key requirement on the public LLM API (/api/v1/*), granting unauthenticated access to the instance owner's configured provider resources.\n\n## Affected Component\n\n- src/dashboardGuard.js  \n- isLocalRequest() — trusts the client-supplied X-9r-Real-Ip header to decide loopback origin  \n- canAccessPublicLlmApi() — grants access to /api/v1/* when isLocalRequest() returns true, skipping API-key validation  \n- Verified affected route: GET /api/v1/models  \n- Product version tested: 9router-app 0.5.4 (Next.js 16.2.9)\n## Root Cause\n\nThe authorization layer makes a security decision based on a client-controllable HTTP header. isLocalRequest() reads X-9r-Real-Ip and, if its value is a loopback address (127.0.0.1), classifies the request as local. The design assumes this header can only be set by the trusted custom-server.js wrapper (which derives it from the unspoofable socket address and strips any inbound copy). When the application is served without that wrapper, Next.js passes the attacker-supplied header through unchanged, so the trust assumption is violated:\n\n```text\nUntrusted Client Input\n        ↓\nX-9r-Real-Ip: 127.0.0.1\n        ↓\nisLocalRequest()  → true\n        ↓\ncanAccessPublicLlmApi()  → allowed (API key not required)\n        ↓\n200 OK\n```\n\n## Attack Scenario\n\n1. The instance is deployed in a mode that does not use custom-server.js, and the LLM API is reachable by the attacker (the default bind is 0.0.0.0).\n2. The attacker sends a normal request to /api/v1/models and receives 401 Unauthorized (API key required for remote access).\n3. The attacker re-sends the identical request with the single added header X-9r-Real-Ip: 127.0.0.1.\n4. The request is classified as local, the API-key check is skipped, and the attacker receives 200 OK with the owner's model catalog and ongoing access to the LLM API.\n\n## Proof of Concept\n\n### Baseline Request\n<img width=\"1211\" height=\"402\" alt=\"Screenshot 2026-06-19 174727\" src=\"https://github.com/user-attachments/assets/170b635f-1bd6-4dfd-ad85-30a03a9f6f72\" />\n\n### Exploit Request\n\n<img width=\"1207\" height=\"816\" alt=\"Screenshot 2026-06-19 174844\" src=\"https://github.com/user-attachments/assets/b7b4efde-c071-4aa2-ab13-9bde7c88a7b8\" />\n\n\nThe only difference between the two requests is the addition of X-9r-Real-Ip: 127.0.0.1.\n## Impact\n\nAn unauthenticated remote attacker who can reach the service can bypass API-key enforcement on the public LLM API and act as a trusted local client. Consequences include:\n\n- Unauthorized use of the owner's configured LLM provider connections\n- Consumption of paid API credits / financial loss to the instance owner\n- Abuse of upstream provider accounts via the proxy\n- Enumeration of configured providers and available models\n\n## Remediation\n\n- Do not trust X-9r-Real-Ip (or any X-9r-* header) when received directly from clients.\n- Derive the client address for authorization from a trusted transport-level source, e.g. req.socket.remoteAddress, rather than a request header.\n- If custom-server.js is required for the security model, fail closed when its trusted marker is absent, and explicitly strip/reject any inbound client-supplied X-9r-* headers at the edge.\n- Document supported, secure startup modes so the application is not run in a configuration where the header is attacker-controllable.","state":0,"publishedAt":"2026-09-22T16:34:06+00:00","modifiedAt":"2026-09-22T17:15:10.4025618+00:00","affected":[{"ecosystem":"npm","name":"9router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.5.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8","https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3","https://github.com/decolua/9router","https://github.com/decolua/9router/releases/tag/v0.5.6"],"sourceUrl":"https://github.com/advisories/GHSA-5mj8-gf6m-fhw8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5mj8-gf6m-fhw8","identifiers":["GHSA-5mj8-gf6m-fhw8","CVE-2026-56681"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T07:54:58.2349119+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T07:54:58.2349119+00:00","lastSuccessAt":"2026-11-12T07:54:58.4848198+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.4848225+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-1225a640a70b576ed1a85d2671a302d70a8e18168f570c1f4912faf8f66b1119","complete":true,"records":424623,"lastAttemptAt":"2026-11-12T07:53:22.876714+00:00","lastSuccessAt":"2026-11-12T07:53:22.8444514+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:53:22.876714+00:00","snapshotPublishedAt":"2026-11-12T07:24:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-570328139368428ca550af1570d01579","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T07:55:38.9446123+00:00","lastSuccessAt":"2026-11-12T06:55:06.923+00:00","error":null,"lastVerifiedAt":"2026-11-12T06:55:06.923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T07:54:58.2349119+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T07:54:58.2349119+00:00","lastSuccessAt":"2026-11-12T07:54:58.4862124+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.4862143+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8017f5c1a44c430b920cd4f30d507e78","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T07:55:38.3687422+00:00","lastSuccessAt":"2026-11-12T07:55:38.365+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:55:38.365+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T07:54:58.021445+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.021445+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T07:53:23.1198989+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:53:23.1198989+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T07:54:58.1995224+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.1995224+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-3c15e3b4b3da393566ac7be69c095bef52c252ec437d24c4c6ea68ed9e4af0f5","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T07:54:57.8931777+00:00","lastSuccessAt":"2026-11-12T07:54:56.4668314+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:57.8931777+00:00","snapshotPublishedAt":"2026-11-12T07:33:19+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}