CVE-2026-55501: 9Router Login Rate-Limit Bypass – Dashboard Brute-Force Risk

Technical summary

The vulnerability resides in src/lib/auth/loginLimiter.js and src/app/api/auth/login/route.ts, where the login rate limiter derives client identity from the X-Forwarded-For header without validation. An attacker can craft requests with different X-Forwarded-For values to receive a fresh rate-limit bucket for each attempt, circumventing the intended 5-attempt threshold and progressive lockout mechanism. The root cause is CWE-307 (Improper Restriction of Rendered UI Layers or Frames)—in this context, improper trust in a user-controllable identifier for security-critical decisions. The fix in version 0.4.80 implements proper client identification, either through reverse-proxy configuration validation or by deriving identity from trusted network sources.

Business impact

Organizations running 9Router as an AI router and token management solution face direct risk to dashboard account takeover. Compromised dashboard credentials grant attackers control over router configuration, token handling, and potentially network traffic interception depending on deployment scope. For enterprises using 9Router in production or shared environments, this exposes API keys, authentication tokens, and router settings to unauthorized modification. The ease and speed of exploitation means remediation should be prioritized alongside any incident investigation for systems that may have been exposed prior to patching.

Affected systems

9Router versions prior to 0.4.80 are affected. Organizations must verify their installed version and audit deployment scope—specifically, which networks can reach the dashboard login endpoint. Public-facing dashboards face immediate risk; internal-only deployments reduce exposure but do not eliminate it if an insider or network-adjacent attacker is present. No other products are explicitly listed as affected.

Exploitability

This vulnerability is trivial to exploit and requires no special tools or authentication. An attacker with network access to the dashboard endpoint can use a simple script or even manual curl commands to cycle through X-Forwarded-For values while submitting password guesses. No user interaction is required, and the attack scales to thousands of attempts per minute. The barrier to exploitation is extremely low—a proof-of-concept is straightforward—making this a high-priority threat if the dashboard is reachable from untrusted networks.

Remediation

Upgrade 9Router to version 0.4.80 or later. This version corrects the rate-limiter logic to derive client identity from trusted sources rather than attacker-controlled headers. After patching, review dashboard access logs for any suspicious brute-force patterns or failed authentication clusters that may indicate prior exploitation. If the dashboard was publicly exposed, rotate all dashboard credentials and audit recent administrative actions. Additionally, restrict dashboard network access to trusted subnets via firewall or reverse-proxy rules as a defense-in-depth measure.

Patch guidance

Upgrading to 9Router 0.4.80 is mandatory. Consult the official 9Router release notes and changelog to confirm any breaking changes or configuration adjustments required during the upgrade. Test the upgrade in a non-production environment first, particularly if 9Router handles critical token or routing functions. No workarounds are available short of network-level access controls; patching is the only reliable fix.

Detection guidance

Review dashboard authentication logs for patterns consistent with brute-force attempts: multiple failed login attempts from different X-Forwarded-For values within a short time window, originating from the same source IP address or user-agent string. Monitor for successful logins immediately following such patterns. Implement alerting on failed authentication clusters (e.g., >20 failures per minute from any unique source IP). Network detection can flag HTTP requests to the login endpoint with rapidly rotating X-Forwarded-For headers. If prior monitoring is unavailable, analyze historical logs for evidence of credential compromise or unauthorized dashboard configuration changes during the window of exposure.

Why prioritize this

This vulnerability merits immediate attention due to its trivial exploitability, high impact (credential compromise leading to dashboard takeover), and the lack of authentication barriers. The CVSS 3.1 score of 7.3 (HIGH) reflects the combination of network-accessible attack surface and confidentiality/integrity/availability impact. Organizations should treat this as critical if their 9Router dashboard is reachable from the internet or untrusted networks.

Risk score, explained

CVSS 3.1 score of 7.3 reflects: Attack Vector=Network (AV:N, exploitable remotely without special conditions), Attack Complexity=Low (AC:L, no special setup required), Privileges Required=None (PR:N, unauthenticated), User Interaction=None (UI:N, fully automated), Scope=Unchanged (S:U), and impact on Confidentiality, Integrity, and Availability all rated as Low (L). While individual impact metrics are modest, the aggregate risk is elevated by the ease of exploitation and the sensitive nature of dashboard compromise. Organizations with critical 9Router deployments should consider this a practical critical-priority item.

Frequently asked questions