9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

Source published

10 Jul 2026 15:28:27 UTC

Source modified

10 Jul 2026 15:41:31 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

Source published

Jul 10, 2026, 3:28:27 PM (timezone not stated)

Source modified

Jul 10, 2026, 3:41:31 PM (timezone not stated)

Observed here

7 Nov 2026 12:32:16 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

Source published

10 Jul 2026 16:16:33 UTC

Source modified

25 Oct 2026 15:10:00 UTC

Observed here

27 Oct 2026 15:15:14 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

## Summary The `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the `ALWAYS_PROTECTED` middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover. ## Description The endpoint `/api/settings/database` is listed in `ALWAYS_PROTECTED` in `dashboardGuard.js` (line 42), which requires a valid JWT token or CLI token. However, this protection is insufficient because: 1. **GET (Export):** Returns the complete database including API keys (`key` field in `apiKeys` table), OAuth tokens, and all provider credentials. Line 80 in `src/lib/db/index.js`: `apiKeys: db.all("SELECT * FROM apiKeys").map(...)` — the `key` field contains the plaintext API key value. 2. **POST (Import):** Accepts arbitrary JSON and performs a complete database wipe-and-replace in a transaction (lines 102-163 in `src/lib/db/index.js`). This replaces all settings including the password hash, effectively allowing an attacker to set their own password. 3. The exported data includes `apiKeys` with their plaintext `key` values, `providerConnections` with all OAuth tokens, and `settings` with OIDC client secrets. ### Evidence **File:** `src/app/api/settings/database/route.js` ```javascript export async function GET() { const payload = await exportDb(); return NextResponse.json(payload); } export async function POST(request) { const payload = await request.json(); await importDb(payload); // ... } ``` **File:** `src/lib/db/index.js` (lines 96-163) ```javascript export async function importDb(payload) { db.transaction(() => { // Wipe all tables db.run(`DELETE FROM settings`); db.run(`DELETE FROM providerConnections`); db.run(`DELETE FROM providerNodes`); db.run(`DELETE FROM proxyPools`); db.run(`DELETE FROM apiKeys`); db.run(`DELETE FROM combos`); db.run(`DELETE FROM kv WHERE scope IN (...)`); // Then insert attacker-controlled data // ... }); } ``` The `exportDb` function at line 80 exposes API key plaintext: ```javascript apiKeys: db.all(`SELECT * FROM apiKeys`).map((r) => ({ id: r.id, key: r.key, name: r.name, ... })), ``` ## Steps to Reproduce 1. Authenticate with any valid JWT (e.g., using the default password "123456") 2. Export: `curl -b auth_token=<jwt> http://localhost:20128/api/settings/database` 3. Observe: Full database dump with all credentials in plaintext 4. Import malicious data: `curl -X POST -b auth_token=<jwt> -H "Content-Type: application/json" -d '<modified-db>' http://localhost:20128/api/settings/database` 5. All settings, passwords, API keys are now replaced with attacker-controlled values ## Impact - **Confidentiality:** Complete exposure of all stored secrets (API keys, OAuth tokens, OIDC client secrets) - **Integrity:** Complete database replacement with attacker-controlled data - **Availability:** Database wipe is possible by importing an empty database - **Scope Changed:** Importing new settings affects all users and downstream services ## Recommended Fix 1. Require re-authentication for database export/import (not just an existing session) 2. Mask/redact API keys in export (or require explicit opt-in for key export) 3. Add confirmation step for import (require current password verification) 4. Implement database backup before import 5. Log all export/import operations with audit trail

Source published

6 Jul 2026 21:37:49 UTC

Source modified

6 Jul 2026 21:56:32 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Publisher rating · CRITICAL