Unauthenticated Information Disclosure in 9Router

Executive Summary

CVE-2026-62327 is an unauthenticated information disclosure vulnerability in 9Router versions up to and including 0.4.41. The vulnerability exists because the /api/usage/stats endpoint lacks proper authentication middleware.

A remote attacker can send a single unauthenticated request to this endpoint to retrieve sensitive information, including plaintext API keys for all connected AI provider accounts. Alongside the API keys, the attacker can also obtain token counts, cost breakdowns, and request metadata.

This vulnerability allows unauthorized access to AI provider accounts, which can lead to further exploitation such as billing fraud or quota exhaustion.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check if the /api/usage/stats endpoint in 9Router (versions up to 0.4.41) is accessible without authentication. This can be done by sending an unauthenticated HTTP request to the endpoint and observing if sensitive information, such as API keys, is returned.

• Use the following curl command to test for the vulnerability: curl -i http://<target-ip-or-domain>/api/usage/stats
• If the response includes plaintext API keys, token counts, cost breakdowns, or request metadata, the system is vulnerable.
• You can also use network scanning tools like Burp Suite, OWASP ZAP, or Postman to send unauthenticated requests to the endpoint and analyze the response.
• Check server logs for unusual access to the /api/usage/stats endpoint, especially from unauthorized or external IP addresses.

Useful 0 Not Useful 0

Impact Analysis

If you are using 9Router through version 0.4.41, this vulnerability can have several impacts:

• Unauthorized access to your AI provider accounts: Attackers can retrieve plaintext API keys, allowing them to impersonate your accounts.
• Billing fraud: Attackers can use the stolen API keys to make unauthorized requests, leading to unexpected charges on your AI provider accounts.
• Quota exhaustion: Attackers can consume your AI provider account quotas, potentially disrupting your services.
• Exposure of sensitive metadata: The attacker can access token counts, cost breakdowns, and request metadata, which may contain confidential business information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the exposed API keys or metadata include personal data of EU citizens, unauthorized access could lead to a data breach. GDPR requires organizations to implement appropriate security measures to protect personal data, and failure to do so may result in significant fines.
• HIPAA (Health Insurance Portability and Accountability Act): If the AI provider accounts or metadata involve protected health information (PHI), the unauthorized disclosure of this information could violate HIPAA's Privacy and Security Rules. Covered entities and business associates must safeguard PHI, and a breach could lead to penalties.
• Other standards: Depending on the nature of the data exposed, this vulnerability could also affect compliance with other industry-specific regulations or standards, such as PCI DSS for payment card data or SOC 2 for service organizations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade 9Router to a version beyond 0.4.41 if a patched version is available. Check the vendor's official channels for updates.
• If upgrading is not immediately possible, restrict access to the /api/usage/stats endpoint by implementing authentication middleware. Ensure that only authenticated and authorized users can access this route.
• Rotate all exposed API keys for connected AI provider accounts to prevent unauthorized use, billing fraud, or quota exhaustion.
• Implement network-level protections such as firewalls or access control lists (ACLs) to block unauthorized access to the vulnerable endpoint.
• Monitor network traffic and logs for suspicious activity targeting the /api/usage/stats endpoint.
• Consider temporarily disabling the /api/usage/stats endpoint if it is not critical to operations until a patch is applied.

Useful 0 Not Useful 0