Skip to content
OpenAdvisories

Vendor

decolua

26 known vulnerabilities.

Products

9Router 26
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-63732

    9router before 0.4.60 Remote Code Execution via default password

    9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child…

    decolua 9Router
  • Critical 9.8
    CVE-2026-49352 Public exploit

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attack…

    decolua 9Router 9router npm
  • Critical 10.0
    CVE-2026-46339 Public exploit Scanner template

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js a…

    decolua 9Router 9router npm
  • Critical 9.1
    CVE-2026-62327

    9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

    9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/st…

    decolua 9Router
  • Critical 9.8
    CVE-2026-59801 Scanner template

    9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

    9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js…

    decolua 9Router 9router npm
  • Critical 9.9
    CVE-2026-55500

    9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

    9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication…

    decolua 9Router 9router npm
  • Critical 9.8
    CVE-2026-59800

    9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

    9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword fie…

    decolua 9Router 9router npm