CVE-2026-56682
Deferred Deferred - Pending Action

Authentication Bypass in 9Router via X-9r-Real-Ip Header Manipulation

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-56682
EUVD
EUVD-2026-84542

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
decolua 9router 0.5.6
9router 9router 0.5.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects 9Router versions before 0.5.6. It allows attackers to bypass login brute-force protection by spoofing the X-9r-Real-Ip header. The rate-limiting mechanism uses this header to track failed login attempts, but attackers can rotate the header value with each request to create new rate-limiting buckets. This prevents the lockout mechanism from ever triggering after five failed attempts, enabling unlimited password guessing against the dashboard login.

Detection Guidance

Check if your 9router deployment allows requests to reach Next.js without the sanitizing custom-server.js wrapper. Monitor for repeated login attempts with varying X-9r-Real-Ip headers. Use network logs to detect unthrottled password guessing attempts targeting /api/auth/login.

Impact Analysis

An attacker could exploit this to guess passwords indefinitely against the 9Router dashboard login. If successful, they could gain administrative access to the system. The default network binding and dashboard password make exploitation easier. The vulnerability increases the risk of unauthorized account takeover.

Mitigation Strategies

Upgrade to 9router version 0.5.6 or later. Ensure the custom-server.js wrapper is properly deployed to sanitize headers. Implement rate-limiting based on transport-level peer addresses instead of client-controllable headers. Add global attempt ceilings and exponential backoff for login attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart