CVE Feed

    Dashboard / CVE / CVE-2026-63313

    CVE-2026-63313

    9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

    Published:Jul 23, 2026
    Last Modified:Jul 24, 2026
    EPS:Jul 23, 2026
    EPSS Score:0.00336
    CVSS Score:7.7

    Affected Products

    Vendor
    Decolua
    Product
    9router

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-72860 (CVSS 6.3) — The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side …
    CVE-2026-56677 (CVSS 8.6) — 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/…
    CVE-2026-63732 (CVSS 9.4) — 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) th…
    CVE-2026-62312 (CVSS 8.8) — 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achie…
    CVE-2026-56678 (CVSS 6.4) — 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/ki…
    CVE-2026-56679 (CVSS 8.7) — 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire requ…
    CVE-2026-49353 (CVSS 7.5) — 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only acces…
    CVE-2026-49352 (CVSS 9.8) — 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secre…
    CVE-2026-46339 (CVSS 10) — 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not pro…
    CVE-2026-62328 (CVSS 8.7) — 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows rem…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High