CVE-2026-59801 Details
Description
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.
A vulnerability in 9Router versions through 0.4.41 allows remote attackers to access provider management API endpoints without authentication. This issue arises from the absence of authentication middleware in Next.js API routes related to providers. Exploitation of this vulnerability enables attackers to enumerate, create, modify, or delete provider connections, potentially leading to the exposure of partial credentials, OAuth tokens, and API keys. Additionally, it could allow redirection of AI traffic to attacker-controlled servers or cause a complete denial of service by deleting all provider connections.
Add authentication middleware to all '/api/providers/*' and '/api/usage/*' routes. Ensure that full API key strings are never returned in API responses, and implement proper authorization checks so users can only access their own data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/9router-unauthenticated-api-exposure-via-api-providers | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| decolua 9router | <= 0.4.41 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |