Loading story…
decolua disclosed and fixed CVE-2026-55500 in 9Router, a high-severity flaw affecting versions earlier than 0.4.80 that left the /api/settings/database endpoint insufficiently protected. The issue allowed database export and import operations that could expose stored credentials, API keys, OAuth tokens, and configuration data, while also enabling a complete database overwrite that could hand an attacker control over the application state.
The remediation adds re-authentication for database export and import by requiring the current dashboard password, except for requests using a CLI token, and updates the UI to prompt for that password before sensitive operations. The same security patch also introduced an SSRF guard for /v1/web/fetch to block requests to localhost, internal hostnames, private IPv4 ranges, and private or loopback IPv6 addresses, addressing a separate server-side request forgery risk referenced alongside the database protection fix.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for the 9Router database export/import vulnerability was updated with references, affected version information, and an SSVC assessment. The synopsis states the issue affects versions earlier than 0.4.80, enables credential theft and database takeover, and that GitHub published a security advisory while decolua fixed it in version 0.4.80.
A GitHub commit introduced a fix requiring the current dashboard password for `/api/settings/database` export and import requests, addressing the vulnerable unauthenticated access path. The same commit also added an SSRF guard for `/v1/web/fetch` and referenced advisory GHSA-qvfm-67h2-2qfx.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-49352** was disclosed in decolua's **9Router**, where versions `0.2.21` through `0.4.43` used a hardcoded fallback JWT signing secret when `JWT_SECRET` was unset. An attacker could exploit the static secret to forge an `auth_token` cookie and bypass authentication, exposing systems to full compromise of confidentiality, integrity, and availability. The flaw is classified as **CWE-798** and carries a critical **CVSS 9.8** severity. The issue was fixed in **9Router 0.4.44** by removing the hardcoded default secret and changing the application to load the signing key from the `JWT_SECRET` environment variable or a persisted file under `~/.9router/jwt-secret`, generating a random 32-byte hex secret if none exists. Project updates also revised documentation to reflect the new secret-handling behavior and expanded protected API coverage to include `/api/translator`, reducing the risk of unauthorized access through improperly secured dashboard functions.
Jul 16, 2026
A high-severity vulnerability tracked as **CVE-2026-62327** affects decolua's **9Router** through version **0.4.41**, allowing remote attackers to retrieve plaintext API keys for all connected AI provider accounts without authentication. The flaw stems from missing authentication middleware on the Next.js API route `/api/usage/stats`, enabling a single unauthenticated request to disclose sensitive account data. In addition to API keys, the exposed response can include token counts, cost breakdowns, and request metadata, creating risks of unauthorized use of linked AI services, billing fraud, and quota exhaustion. The issue is classified as an information disclosure vulnerability tied to **CWE-306** and **CWE-522**, with a **CVSS 3.1 score** reflecting high impact from network-accessible exploitation requiring no privileges or user interaction.
Jul 14, 2026
A critical vulnerability tracked as **CVE-2026-59801** affects **9Router** through version `0.4.41`, exposing provider management functions through the `/api/providers` API without authentication. The flaw stems from missing authentication middleware in Next.js routes under `src/app/api/providers/*`, allowing remote attackers to reach sensitive endpoints with no credentials. The issue has been rated **9.8 CVSS v3.1** and classified as **CWE-306: Missing Authentication for Critical Function**. Attackers can use the exposed API to enumerate, create, modify, or delete provider connections, potentially revealing partial credentials, OAuth tokens, and API keys. The access could also let an attacker redirect AI traffic to attacker-controlled servers or trigger a denial of service by deleting all provider connections. Reported mitigation is to add authentication middleware and enforce access controls across the affected API routes and endpoints.
Jul 15, 2026