CVE-2026-62327 Details
Description
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.
A vulnerability allowing unauthenticated information disclosure has been identified in 9Router versions through 0.4.41. This vulnerability allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. The issue arises from the absence of authentication middleware on several Next.js API routes, enabling unauthorized access to sensitive data. Exploitation of this vulnerability could lead to unauthorized use of AI provider accounts, billing fraud, and exhaustion of usage quotas.
As of now, there is no official patch available for this vulnerability. However, it is recommended to add authentication middleware to the affected API routes and to never return full API key strings in API responses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 | CISA-ADP | AdvisoryBundleExploitRemedyVendor |
| https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 | [email protected] | AdvisoryBundleExploitRemedyVendor |
| https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| decolua 9router | <= 0.4.41 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 13, 2026 | New CVE Received | [email protected] |