CVE-2026-56675: 9Router Authentication Bypass via Loopback Trust Abuse

Technical summary

The vulnerability exists in src/dashboardGuard.js, which implements an authentication check that exempts requests originating from 127.0.0.1. In typical deployments, this is reasonable—localhost requests are trusted. However, when a reverse proxy (such as Nginx or Apache) sits between the public internet and 9Router, it forwards external requests through the loopback interface, preserving the source IP as 127.0.0.1 in the backend's view. The guard cannot distinguish between legitimate local requests and proxied external traffic, allowing unauthenticated access to /v1/* endpoints. Attackers can enumerate /v1/models and exploit /v1 proxy endpoints to access configured credentials for upstream AI providers (OpenAI, Anthropic, etc.) depending on which providers are enabled in the deployment.

Business impact

Organizations using 9Router to manage and optimize API calls to multiple AI providers face immediate credential exposure. Attackers can extract API keys and authentication tokens for expensive third-party services, leading to unauthorized API consumption, billing fraud, and data exfiltration through compromised provider accounts. The vulnerability bypasses all authentication mechanisms, making it trivial to exploit at scale once discovered. Token saver deployments that aggregate requests across teams amplify the blast radius by concentrating credentials in a single target. Reputational damage follows if customer data or sensitive prompts flow through compromised upstream accounts.

Affected systems

9Router versions prior to 0.5.2 are affected. The vulnerability manifests specifically in deployments where 9Router is accessed via a reverse proxy on the same host—a common architecture in containerized and cloud environments. Single-machine deployments without a reverse proxy, or those where the reverse proxy is on a different host, are not vulnerable because the loopback assumption holds. The flaw is version-agnostic once exposed; any HTTP client with network access to the reverse proxy can trigger it.

Exploitability

Exploitability is very high. No authentication is required; no user interaction is needed; the attack is straightforward HTTP requests to publicly documented endpoints. An attacker needs only to identify that 9Router is running behind a reverse proxy (detectable via banner grabbing or endpoint enumeration) and send requests to /v1/models or /v1 proxy endpoints. The lack of authentication barriers and the simplicity of the attack vector—sending unauthenticated HTTP requests—makes this trivial to weaponize. The CVSS score of 8.3 reflects the network-accessible nature, low attack complexity, and consequences spanning confidentiality, integrity, and availability of upstream services.

Remediation

Upgrade 9Router to version 0.5.2 or later immediately. This version corrects the authentication guard to validate API keys or bearer tokens regardless of source IP, eliminating the loopback trust bypass. After patching, conduct a credential audit: rotate all API keys and tokens for upstream providers (OpenAI, Anthropic, Azure, etc.) that were configured in 9Router during the window the system was unpatched. Review access logs to detect any unauthorized /v1 endpoint calls and investigate downstream provider accounts for anomalous API usage and billing charges.

Patch guidance

The fix is contained in 9Router version 0.5.2. Review the official 9Router repository and release notes to confirm the version availability for your deployment method (Docker, npm, binary, etc.). If you are running an older release, update through your package manager or container registry. Verify the patch by confirming the version reported in the application's version endpoint after deployment. Test in a non-production environment first to ensure compatibility with your upstream provider configurations.

Detection guidance

Monitor HTTP access logs for unauthenticated requests to /v1/* endpoints, particularly /v1/models and /v1/proxy/* paths. Look for requests without Authorization headers or API keys originating from outside your organization. Implement network segmentation to restrict direct access to 9Router; enforce all traffic through the reverse proxy with additional authentication layers (OAuth2, mTLS, IP whitelisting). Deploy runtime monitoring to alert on repeated failed or successful authentication attempts. Check 9Router application logs for access patterns that bypass the dashboard guard. If available, enable audit logging for all API token usage to detect credential abuse on upstream providers.

Why prioritize this

This vulnerability merits immediate patching due to the combination of remote exploitability without authentication, direct exposure of high-value credentials (AI provider API keys), and the potential for significant financial and data theft. Organizations running 9Router in production, especially those managing shared token pools across teams, should treat this as a critical security incident until patched. The ease of exploitation and the concentration of credentials in a single service elevate the risk above typical HIGH-severity flaws.

Risk score, explained

The CVSS 8.3 (HIGH) score reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), no privilege required (PR:N), and no user interaction (UI:N). The scope is changed (S:C) because compromising 9Router impacts external systems (upstream providers). Confidentiality, integrity, and availability are all impacted: credentials are disclosed (C:L), attacker can modify requests (I:L), and upstream service abuse can degrade availability (A:L). The score does not fully capture the cascading impact on third-party provider accounts, which could justify emergency response even beyond the numerical rating.

Frequently asked questions