Loading story…
A high-severity vulnerability tracked as CVE-2026-62327 affects decolua's 9Router through version 0.4.41, allowing remote attackers to retrieve plaintext API keys for all connected AI provider accounts without authentication. The flaw stems from missing authentication middleware on the Next.js API route /api/usage/stats, enabling a single unauthenticated request to disclose sensitive account data.
In addition to API keys, the exposed response can include token counts, cost breakdowns, and request metadata, creating risks of unauthorized use of linked AI services, billing fraud, and quota exhaustion. The issue is classified as an information disclosure vulnerability tied to CWE-306 and CWE-522, with a CVSS 3.1 score reflecting high impact from network-accessible exploitation requiring no privileges or user interaction.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A vulnerability affecting decolua's 9Router through version 0.4.41 was disclosed, describing an unauthenticated request to /api/usage/stats that can expose plaintext API keys and related usage metadata for connected AI provider accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability tracked as **CVE-2026-59801** affects **9Router** through version `0.4.41`, exposing provider management functions through the `/api/providers` API without authentication. The flaw stems from missing authentication middleware in Next.js routes under `src/app/api/providers/*`, allowing remote attackers to reach sensitive endpoints with no credentials. The issue has been rated **9.8 CVSS v3.1** and classified as **CWE-306: Missing Authentication for Critical Function**. Attackers can use the exposed API to enumerate, create, modify, or delete provider connections, potentially revealing partial credentials, OAuth tokens, and API keys. The access could also let an attacker redirect AI traffic to attacker-controlled servers or trigger a denial of service by deleting all provider connections. Reported mitigation is to add authentication middleware and enforce access controls across the affected API routes and endpoints.
Jul 15, 2026
decolua disclosed and fixed **CVE-2026-55500** in 9Router, a high-severity flaw affecting versions earlier than `0.4.80` that left the `/api/settings/database` endpoint insufficiently protected. The issue allowed database export and import operations that could expose stored credentials, API keys, OAuth tokens, and configuration data, while also enabling a complete database overwrite that could hand an attacker control over the application state. The remediation adds re-authentication for database export and import by requiring the current dashboard password, except for requests using a CLI token, and updates the UI to prompt for that password before sensitive operations. The same security patch also introduced an SSRF guard for `/v1/web/fetch` to block requests to localhost, internal hostnames, private IPv4 ranges, and private or loopback IPv6 addresses, addressing a separate server-side request forgery risk referenced alongside the database protection fix.
Jul 10, 2026
A critical vulnerability tracked as **CVE-2026-49352** was disclosed in decolua's **9Router**, where versions `0.2.21` through `0.4.43` used a hardcoded fallback JWT signing secret when `JWT_SECRET` was unset. An attacker could exploit the static secret to forge an `auth_token` cookie and bypass authentication, exposing systems to full compromise of confidentiality, integrity, and availability. The flaw is classified as **CWE-798** and carries a critical **CVSS 9.8** severity. The issue was fixed in **9Router 0.4.44** by removing the hardcoded default secret and changing the application to load the signing key from the `JWT_SECRET` environment variable or a persisted file under `~/.9router/jwt-secret`, generating a random 32-byte hex secret if none exists. Project updates also revised documentation to reflect the new secret-handling behavior and expanded protected API coverage to include `/api/translator`, reducing the risk of unauthorized access through improperly secured dashboard functions.
Jul 16, 2026