CVE-2026-55501 Details
Description
9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.
A vulnerability in 9Router's dashboard login mechanism prior to version 0.4.80 allows remote attackers to bypass rate limiting and lockout features. The issue arises because the login rate limiter relies on the X-Forwarded-For HTTP header, which can be easily spoofed by attackers. This vulnerability is present in versions 0.4.71 and prior.
Users can update to 9Router version 0.4.80 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/decolua/9router/commit/7648c3412b403a29f04967c4b4e9725e228791d4 | [email protected] | Source CodeVendor |
| https://github.com/decolua/9router/releases/tag/v0.4.80 | [email protected] | Release NotesVendor |
| https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| decolua 9router | <= 0.4.71 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |