CVE-2026-49352 Details
Description
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44
A vulnerability in 9Router versions 0.2.21 prior to 0.4.44 allows authentication bypass due to a hardcoded fallback JWT secret. When the JWT_SECRET environment variable is not set, the application uses '9router-default-secret-change-me' as the secret for signing JWTs used in dashboard authentication. This allows attackers to forge valid auth_token cookies and gain unauthorized access to the dashboard and API. The vulnerability affects all public 9Router servers that do not have JWT_SECRET configured.
Users are advised to set the JWT_SECRET environment variable before starting the application. If JWT_SECRET is not set, the application should fail to start rather than falling back to the default secret. Alternatively, the application can be updated to automatically generate a random secret on first boot and save it to the data directory, but should never use a publicly known constant as a fallback.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decolua/9router/security/advisories/GHSA-jphh-m39h-6gwx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/decolua/9router/commit/fe3ce25ae3cda48c0702c2d452e17f6ec214009d | [email protected] | Source CodeVendor |
| https://github.com/decolua/9router/releases/tag/v0.4.44 | [email protected] | Release NotesVendor |
| https://github.com/decolua/9router/security/advisories/GHSA-jphh-m39h-6gwx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| decolua 9router | >= 0.2.21, <= 0.4.30 (semver) >= 0.4.31, <= 0.4.41 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |