CVE Feed

    Dashboard / CVE / CVE-2026-49352

    CVE-2026-49352

    9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

    Published:Jul 15, 2026
    Last Modified:Jul 16, 2026
    EPS:Jul 15, 2026
    EPSS Score:0.00601
    CVSS Score:9.8

    Affected Products

    Vendor
    Decolua
    Product
    9router

    Exploits

    https://github.com/covepseng/cve-2026-49352-poc

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2026-72860 (CVSS 6.3) — The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side …
    CVE-2026-56677 (CVSS 8.6) — 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/…
    CVE-2026-63732 (CVSS 9.4) — 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) th…
    CVE-2026-63313 (CVSS 8.3) — 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoin…
    CVE-2026-62312 (CVSS 8.8) — 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achie…
    CVE-2026-56678 (CVSS 6.4) — 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/ki…
    CVE-2026-56679 (CVSS 8.7) — 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire requ…
    CVE-2026-49353 (CVSS 7.5) — 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only acces…
    CVE-2026-46339 (CVSS 10) — 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not pro…
    CVE-2026-62328 (CVSS 8.7) — 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows rem…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High