9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass
Priority HIGH 82CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-798.
Summary
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00601 48th percentileScored 2026-11-07
Fix Fixed 9router (decolua): 0.4.449router (npm): 0.4.45
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| decolua | 9router | 0.2.21 to before 0.4.44 | 0.4.44 | Patch available | CNA |
| — | 9router (npm) | 0.2.21 to before 0.4.45 | 0.4.45 | Patch available | GHSA-jphh-m39h-6gwx |
- 9router Vendordecolua Affected 0.2.21 to before 0.4.44 Fixed in 0.4.44 Patch available CNA
- 9router (npm) Vendor— Affected 0.2.21 to before 0.4.45 Fixed in 0.4.45 Patch available GHSA-jphh-m39h-6gwx
Remediation
- Fix · CNA 9router (decolua) Fixed in 0.4.44
- Fix · GHSA-jphh-m39h-6gwx 9router (npm) Fixed in 0.4.45 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-49352
- 2026-10-03 Alias added: GHSA-jphh-m39h-6gwx
References
More decolua vulnerabilities
- TI-2026-34059 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes CVSS 3.1CRITICAL 10.0
- TI-2026-44499 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats CVSS 4.0CRITICAL 9.3
- TI-2026-42622 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers CVSS 4.0CRITICAL 9.3
- TI-2026-44500 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints CVSS 4.0HIGH 8.7
- TI-2026-40860 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint CVSS 3.1HIGH 8.6
- TI-2026-40165 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass CVSS 3.1HIGH 8.6
Sources
- CVE-2026-49352 · CVE Program
- CVE-2026-49352 · NVD
- FIRST EPSS
- GHSA-jphh-m39h-6gwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences