By weakness (CWE)

CWE-1327: related vulnerabilities

CVEs classified under CWE-1327. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-55641HIGH 8.2

  9Router, an AI router designed to optimize and reduce costs for large language model requests, contains a critical authentication bypass vulnerability in versions before 0.5.2. The vulnerability stems from the application trusting the HTTP Host header—a value supplied by the client—to determine whether a request originates locally. An attacker can spoof this header by claiming to be localhost, bypassing API key authentication entirely. Once authenticated bypass is achieved, attackers gain access to the LLM proxy and can make requests using the router's stored provider credentials, potentially consuming API quota or accessing sensitive upstream services. Additionally, the searxng search provider feature can be exploited to make the server perform requests to internal infrastructure or cloud metadata endpoints, enabling information disclosure or further lateral movement.