Unauthenticated API Access in 9Router

Executive Summary

CVE-2026-59801 is a critical security vulnerability in 9Router versions up to and including 0.4.41. It allows unauthenticated remote attackers to interact with provider management API endpoints due to missing authentication middleware in the Next.js API routes under src/app/api/providers/.

• Attackers can perform CRUD (Create, Read, Update, Delete) operations on the /api/providers endpoint without any credentials.
• This can lead to exposure of sensitive data such as partial credentials, OAuth tokens, and API keys.
• Attackers may redirect AI traffic to malicious servers or cause a denial of service by deleting all provider connections.
• Additional unauthenticated endpoints like /api/usage/stats, /api/usage/request-logs, and /api/usage/request-details/:id expose API keys, request history, and full conversation contents.

The root cause is the lack of authentication middleware on critical API routes in the Next.js dashboard.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check if the 9Router application is running a vulnerable version (<= 0.4.41) and verify if unauthenticated access to critical API endpoints is possible.

• Check the installed version of 9Router by reviewing the package or application logs, or by running a command like `npm list 9router` if it is a Node.js application.
• Use a tool like `curl` or a web browser to send unauthenticated requests to the following endpoints and observe if sensitive data or unauthorized actions are possible:
• - `curl -i http://<target-ip>:<port>/api/providers` (Check if provider data is returned without authentication)
• - `curl -i http://<target-ip>:<port>/api/usage/stats` (Check if API keys or usage data are exposed)
• - `curl -i http://<target-ip>:<port>/api/usage/request-logs` (Check if request logs or conversation data are exposed)
• If these endpoints return data or allow modifications without authentication, the system is vulnerable.

Network scanning tools like `nmap` can also be used to detect open ports and services associated with 9Router, but manual verification of the API endpoints is required to confirm the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts on users or organizations using 9Router.

• Unauthorized access to sensitive data: Attackers can steal API keys, OAuth tokens, and other credentials, leading to unauthorized use of connected AI provider accounts.
• Data exposure: Full conversation histories, system prompts, user messages, and reasoning traces can be leaked, compromising confidentiality.
• Traffic redirection: Attackers can modify provider connections to redirect AI traffic to malicious servers, potentially leading to further exploitation or data breaches.
• Denial of service: Attackers can delete all provider connections, causing a complete disruption of services.
• Reputation and financial damage: Exposure of sensitive data or service disruptions can lead to loss of trust, regulatory penalties, or financial losses.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with various standards and regulations.

• GDPR (General Data Protection Regulation): The exposure of personal data, such as conversation histories and user messages, can lead to violations of GDPR. Unauthorized access to or disclosure of personal data may result in hefty fines (up to 4% of global annual revenue or €20 million, whichever is higher).
• HIPAA (Health Insurance Portability and Accountability Act): If 9Router is used in a healthcare context and processes protected health information (PHI), this vulnerability could lead to unauthorized access to PHI, violating HIPAA's Privacy and Security Rules. This may result in fines and legal consequences.
• Other regulations: Depending on the industry and region, other regulations like CCPA (California Consumer Privacy Act), PCI DSS (Payment Card Industry Data Security Standard), or sector-specific rules may also be violated if sensitive data is exposed or mishandled due to this vulnerability.

Organizations must assess the impact of this vulnerability on their compliance posture and take corrective actions to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

Since no patches are currently available for this vulnerability, the following immediate steps are recommended to mitigate the risk:

• Restrict access to the 9Router application by implementing network-level controls such as firewalls or security groups to limit exposure to trusted IP addresses only.
• Disable or remove the 9Router application if it is not critical to operations until a patch is released.
• Monitor network traffic and logs for suspicious activity, particularly requests to the `/api/providers`, `/api/usage/stats`, `/api/usage/request-logs`, and `/api/usage/request-details/:id` endpoints.
• Rotate any exposed API keys, OAuth tokens, or credentials that may have been leaked through the vulnerable endpoints.
• Review provider connections and audit logs for any unauthorized modifications, deletions, or additions of providers.

Additionally, consider deploying intrusion detection/prevention systems (IDS/IPS) to block unauthorized access attempts to the vulnerable endpoints.

Useful 0 Not Useful 0