Unauthenticated API Access in 9Router

Compliance Impact

The vulnerability allows unauthenticated remote attackers to access sensitive API endpoints without proper authentication, potentially exposing sensitive data or enabling abuse of upstream provider credentials.

Such unauthorized access and potential data exposure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.

By bypassing authentication mechanisms, this vulnerability undermines the confidentiality and integrity of data, which are core requirements in many compliance frameworks.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56675 is a vulnerability in the 9router npm package affecting versions 0.4.80 and earlier. The issue arises because 9router treats loopback requests (requests coming from 127.0.0.1) as trusted and allows access to /v1/* API endpoints without requiring an API key.

When 9router is deployed behind a reverse proxy (such as nginx) that forwards public traffic to the backend via the loopback interface, external requests are misclassified as local. This misclassification bypasses API key authentication, allowing a remote unauthenticated attacker to access sensitive API endpoints like /v1/models.

The root cause is that the backend relies on perceived socket locality rather than properly validating client identity through headers like X-Real-IP or X-Forwarded-For. This allows attackers to spoof their IP and gain unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a high impact because it allows remote unauthenticated attackers to bypass authentication and access sensitive API endpoints.

• Attackers can access /v1 APIs such as /v1/models without an API key.
• Attackers may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers.
• This can lead to unauthorized data access, manipulation, or abuse of services that rely on these APIs.

The vulnerability has a CVSS v3.1 base score of 8.3, indicating a high severity with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your 9router instance is treating loopback requests as trusted and allowing unauthenticated access to /v1 APIs such as /v1/models. Specifically, you should verify if requests forwarded through a reverse proxy to 127.0.0.1 are bypassing API key authentication.

You can inspect network traffic or logs for requests to /v1 endpoints that do not include valid API keys but are still accepted. Additionally, check if headers like X-Forwarded-For or X-Real-IP are being properly handled or ignored.

Suggested commands to detect this issue include:

• Use curl to simulate requests to the vulnerable API endpoints without an API key from the local machine or through the reverse proxy: curl -v http://127.0.0.1:PORT/v1/models
• Check your reverse proxy (e.g., nginx) access logs for requests forwarded to 127.0.0.1 that lack authentication headers but receive successful responses.
• Use tcpdump or similar tools to capture traffic on the loopback interface and analyze if unauthenticated requests are accepted: sudo tcpdump -i lo port PORT
• Inspect the 9router logs for entries showing requests with headers like x-forwarded-for or x-real-ip being ignored or requests marked as local despite coming from external sources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should upgrade 9router to version 0.5.2 or later, where the issue is fixed by properly handling proxy headers and not trusting loopback socket addresses as local when forwarding headers are present.

If upgrading is not immediately possible, configure your reverse proxy to correctly forward client IP information using headers like X-Forwarded-For or X-Real-IP, and ensure 9router is configured to validate these headers to distinguish real client IPs from loopback addresses.

Additionally, require API key authentication for all /v1 API endpoints by default, especially for public listeners, to prevent unauthenticated access.

Review and restrict trusted proxy configurations to avoid confused deputy issues and prevent attackers from spoofing local requests.

Useful 0 Not Useful 0