9Router - Unauthenticated LLM Provider API Exposure

criticalseverity

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication.

Impact

Remote attackers can expose credentials, redirect traffic, or cause denial of service by deleting provider connections.

Fix

Update to the latest version that includes authentication middleware for API routes.

How to confirm it

Send: GET /api/version
Positive when: status_code == 200 and contains(body, "currentVersion") and compare_versions(lsversion, ">=0.0.1", "<=0.4.41")
Send: GET /api/providers
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "authType", "provider", "connections")

Run it with nuclei: nuclei -id CVE-2026-59801 -u <target>

The full check

id: CVE-2026-59801

info:
  name: 9Router - Unauthenticated LLM Provider API Exposure
  author: 0x_Akoko
  severity: critical
  description: |
   9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication.
  impact: |
   Remote attackers can expose credentials, redirect traffic, or cause denial of service by deleting provider connections.
  remediation: |
   Update to the latest version that includes authentication middleware for API routes.
  reference:
    - https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59801
  metadata:
    verified: true
    max-request: 2
    product: 9router
    vendor: decolua
    shodan-query: port:20128 http.html:"9Router"
    fofa-query: port="20128" || title="9Router"
  tags: 9router,unauth,api-exposure,misconfig,api-key-leak

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/version HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "currentVersion")'
          - 'compare_versions(lsversion, ">=0.0.1", "<=0.4.41")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: lsversion
        internal: true
        group: 1
        regex:
          - '"currentVersion"\s*:\s*"([^"]+)"'

  - raw:
      - |
        GET /api/providers HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "authType", "provider", "connections")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from