Loading story…
A critical vulnerability tracked as CVE-2026-49352 was disclosed in decolua's 9Router, where versions 0.2.21 through 0.4.43 used a hardcoded fallback JWT signing secret when JWT_SECRET was unset. An attacker could exploit the static secret to forge an auth_token cookie and bypass authentication, exposing systems to full compromise of confidentiality, integrity, and availability. The flaw is classified as CWE-798 and carries a critical CVSS 9.8 severity.
The issue was fixed in 9Router 0.4.44 by removing the hardcoded default secret and changing the application to load the signing key from the JWT_SECRET environment variable or a persisted file under ~/.9router/jwt-secret, generating a random 32-byte hex secret if none exists. Project updates also revised documentation to reflect the new secret-handling behavior and expanded protected API coverage to include /api/translator, reducing the risk of unauthorized access through improperly secured dashboard functions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability affecting 9Router versions 0.2.21 through before 0.4.44 was fixed in version 0.4.44. Advisory, release, and commit references for CVE-2026-49352 were published on July 15, 2026.
A GitHub commit changed 9Router's JWT handling to stop using the hardcoded default secret "9router-default-secret-change-me." The update instead loads a secret from the JWT_SECRET environment variable or a persisted file, and generates a random secret if none exists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
decolua disclosed and fixed **CVE-2026-55500** in 9Router, a high-severity flaw affecting versions earlier than `0.4.80` that left the `/api/settings/database` endpoint insufficiently protected. The issue allowed database export and import operations that could expose stored credentials, API keys, OAuth tokens, and configuration data, while also enabling a complete database overwrite that could hand an attacker control over the application state. The remediation adds re-authentication for database export and import by requiring the current dashboard password, except for requests using a CLI token, and updates the UI to prompt for that password before sensitive operations. The same security patch also introduced an SSRF guard for `/v1/web/fetch` to block requests to localhost, internal hostnames, private IPv4 ranges, and private or loopback IPv6 addresses, addressing a separate server-side request forgery risk referenced alongside the database protection fix.
Jul 10, 2026
A high-severity vulnerability tracked as **CVE-2026-62327** affects decolua's **9Router** through version **0.4.41**, allowing remote attackers to retrieve plaintext API keys for all connected AI provider accounts without authentication. The flaw stems from missing authentication middleware on the Next.js API route `/api/usage/stats`, enabling a single unauthenticated request to disclose sensitive account data. In addition to API keys, the exposed response can include token counts, cost breakdowns, and request metadata, creating risks of unauthorized use of linked AI services, billing fraud, and quota exhaustion. The issue is classified as an information disclosure vulnerability tied to **CWE-306** and **CWE-522**, with a **CVSS 3.1 score** reflecting high impact from network-accessible exploitation requiring no privileges or user interaction.
Jul 14, 2026
A critical vulnerability tracked as **CVE-2026-59801** affects **9Router** through version `0.4.41`, exposing provider management functions through the `/api/providers` API without authentication. The flaw stems from missing authentication middleware in Next.js routes under `src/app/api/providers/*`, allowing remote attackers to reach sensitive endpoints with no credentials. The issue has been rated **9.8 CVSS v3.1** and classified as **CWE-306: Missing Authentication for Critical Function**. Attackers can use the exposed API to enumerate, create, modify, or delete provider connections, potentially revealing partial credentials, OAuth tokens, and API keys. The access could also let an attacker redirect AI traffic to attacker-controlled servers or trigger a denial of service by deleting all provider connections. Reported mitigation is to add authentication middleware and enforce access controls across the affected API routes and endpoints.
Jul 15, 2026