CVE Feed

    Dashboard / CVE / CVE-2026-56677

    CVE-2026-56677

    9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

    Published:Aug 17, 2026
    Last Modified:Aug 18, 2026
    EPS:Aug 17, 2026
    EPSS Score:0.00271
    CVSS Score:8.6

    Affected Products

    Vendor
    Decolua
    Product
    9router

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-72860 (CVSS 6.3) — The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side …
    CVE-2026-63732 (CVSS 9.4) — 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) th…
    CVE-2026-63313 (CVSS 8.3) — 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoin…
    CVE-2026-62312 (CVSS 8.8) — 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achie…
    CVE-2026-56678 (CVSS 6.4) — 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/ki…
    CVE-2026-56679 (CVSS 8.7) — 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire requ…
    CVE-2026-49353 (CVSS 7.5) — 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only acces…
    CVE-2026-49352 (CVSS 9.8) — 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secre…
    CVE-2026-46339 (CVSS 10) — 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not pro…
    CVE-2026-62328 (CVSS 8.7) — 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows rem…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High