PT-2026-60304 · 9Router · 9Router

CVE-2026-56678 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6

Description The Kiro API-key validation endpoint 'POST /api/oauth/kiro/api-key' builds an upstream URL using a user-controlled region value. An authenticated attacker can provide a crafted region to redirect the Kiro validation request to a host under their control, resulting in the disclosure of the submitted Kiro API key via the Authorization header.

Recommendations Update to version 0.5.6.

Exploit

Fix

SSRF

RCE

Weakness Enumeration

CWE-918

CWE-20

Related Identifiers

CVE-2026-56678

GHSA-6MWV-4MRM-5P3M

Affected Products

9Router

References · 6

• 🔥 https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56678.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-56678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56678 · Security Note
• https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f · Note
• https://github.com/decolua/9router/releases/tag/v0.5.6 · Note