PT-2026-57884 · 9Router · 9Router

Published 2026-07-13 · Updated 2026-07-13 · CVE-2026-59801

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.42

Description An unauthenticated access issue exists due to missing authentication middleware in the Next.js API routes located under src/app/api/providers/*. This allows remote attackers to interact with provider management API endpoints without credentials. Exploitation enables the enumeration, creation, modification, or deletion of provider connections, which can lead to the exposure of partial credentials, OAuth tokens, and API keys. Additionally, attackers could redirect AI traffic to servers under their control or cause a complete denial of service by deleting all provider connections.

Recommendations Update 9Router to version 0.4.42 or later. Restrict access to the src/app/api/providers/* API endpoints as a temporary mitigation measure.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-59801

Affected Products

9Router

References · 4

• https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59801 · Security Note
• https://twitter.com/OrizonCyber/status/2076796337329176822 · Twitter Post
• https://vulncheck.com/advisories/9router-unauthenticated-api-exposure-via-api-providers · Note