Skip to content
OpenAdvisories

Vendor

decolua

26 known vulnerabilities.

Products

9Router 26
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-49352 Public exploit

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attack…

    decolua 9Router 9router npm
  • Critical 10.0
    CVE-2026-46339 Public exploit

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js a…

    decolua 9Router 9router npm