CVE-2026-56682 Details

A vulnerability in 9Router versions prior to 0.5.6 allows remote, unauthenticated attackers to bypass the application's login brute-force protection. In deployments where requests reach Next.js without the sanitizing custom-server.js wrapper, the X-9r-Real-Ip header can be manipulated. This header is used to derive the rate-limit bucket key for login attempts. By rotating the header value with each password guess, an attacker can keep each request under the failed-attempt threshold, effectively disabling the lockout mechanism. This exploitation leads to unthrottled password guessing on the dashboard login, with the potential to gain administrative access if a password is successfully guessed.

Users are advised to update to 9Router version 0.5.6 or later, and to ensure that the application is deployed with the custom-server.js wrapper active.