PT-2026-57906 · 9Router · 9Router

Published 2026-07-13 · Updated 2026-07-14 · CVE-2026-62327

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.42

Description An unauthenticated information disclosure issue exists where remote attackers can retrieve plaintext API keys for all connected AI provider accounts. This occurs due to missing authentication middleware on the Next.js API route at the '/api/usage/stats' endpoint. Exploitation allows the retrieval of full API key strings, token counts, cost breakdowns, and request metadata, which can lead to unauthorized account usage, billing fraud, and quota exhaustion.

Recommendations Update 9Router to version 0.4.42 or later. As a temporary mitigation, restrict access to the '/api/usage/stats' endpoint.

Fix

Insufficiently Protected Credentials

Missing Authentication

Weakness Enumeration

CWE-522

CWE-306

Related Identifiers

CVE-2026-62327

Affected Products

9Router

References · 4

• https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-62327 · Security Note
• https://twitter.com/OrizonCyber/status/2076834089441628423 · Twitter Post
• https://vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats · Note