CVE-2026-56677

Received Received - Intake

Remote Code Execution in 9Router AI Router

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-56677

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability exists in 9Router versions 0.5.4 and earlier. The POST /api/auth/oidc/test endpoint passes a user-controlled issuerUrl parameter to fetchOidcDiscovery() without restricting access to private or loopback network destinations. This allows unauthenticated attackers to scan internal services and manipulate OIDC discovery responses, including token_endpoint and jwks_uri fields.

Detection Guidance

To detect this vulnerability, check if your 9Router instance is running version 0.5.4 or earlier. Inspect network traffic for POST requests to /api/auth/oidc/test with issuerUrl parameters pointing to internal or loopback addresses. Use tools like curl to test the endpoint manually.

Impact Analysis

An attacker could exploit this to scan internal network services, steal sensitive OIDC configuration details, or potentially intercept authentication tokens. If dashboard login is disabled, this attack can be performed without authentication. The impact includes unauthorized access to internal systems and data exposure.

Compliance Impact

This vulnerability could lead to unauthorized data access or exposure, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, regulatory fines, and reputational damage if exploited.

Mitigation Strategies

Upgrade 9Router to a version later than 0.5.4 where the vulnerability is patched. If upgrading is not immediately possible, restrict access to the /api/auth/oidc/test endpoint via firewall rules or disable the dashboard login feature if not needed.

Hi! I’m here to help you understand CVE-2026-56677. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70