CVE Feed

    Dashboard / CVE / CVE-2026-49353

    CVE-2026-49353

    9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

    Published:Jul 15, 2026
    Last Modified:Jul 16, 2026
    EPS:Jul 15, 2026
    EPSS Score:0.00357
    CVSS Score:7.5

    Affected Products

    Vendor
    Decolua
    Product
    9router

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-72860 (CVSS 6.3) — The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side …
    CVE-2026-56677 (CVSS 8.6) — 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/…
    CVE-2026-63732 (CVSS 9.4) — 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) th…
    CVE-2026-63313 (CVSS 8.3) — 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoin…
    CVE-2026-62312 (CVSS 8.8) — 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achie…
    CVE-2026-56678 (CVSS 6.4) — 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/ki…
    CVE-2026-56679 (CVSS 8.7) — 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire requ…
    CVE-2026-49352 (CVSS 9.8) — 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secre…
    CVE-2026-46339 (CVSS 10) — 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not pro…
    CVE-2026-62328 (CVSS 8.7) — 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows rem…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High