CVE-2026-56679

Deferred Deferred - Pending Action

Authentication Bypass in 9Router via PATCH Settings

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-56679

Affected Vendors & Products

Vendor	Product	Version / Range
9router	9router	to 0.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

Executive Summary

This vulnerability affects 9Router versions prior to 0.5.4. The PATCH /api/settings endpoint allows authenticated users to write arbitrary data to persistent settings without restrictions. Attackers can manipulate security-critical fields like requireLogin and disable authentication, granting unauthorized access to protected routes such as /api/keys and /api/providers.

Detection Guidance

Check if your 9Router instance is running a version prior to 0.5.4 by inspecting the version in the admin panel or via API calls. Look for unauthorized modifications to security settings like requireLogin or authentication disablement in the application configuration.

Impact Analysis

An attacker with authenticated access could disable login requirements or authentication entirely, allowing unauthorized users to access sensitive data or administrative functions. This could lead to data theft, unauthorized modifications, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may fail compliance audits due to inadequate access controls and data protection measures.

Mitigation Strategies

Upgrade 9Router to version 0.5.4 or later immediately. Review application settings for unauthorized changes to security-critical fields and revert them if found. Ensure authentication is enforced and protected routes are inaccessible without proper credentials.

Hi! I’m here to help you understand CVE-2026-56679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70