/Vulnerability Library

9Router - Unauthenticated LLM Provider API Exposure

CVE-2026-59801
Verified

Description

9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication.

Severity

Critical

Affected Product

9router

Published Date

July 15, 2026

Template Author

0x_akoko

CVE-2026-59801.yaml
9.5Severity

CVSS Metrics

References

https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86https://nvd.nist.gov/vuln/detail/CVE-2026-59801

Remediation Steps

Update to the latest version that includes authentication middleware for API routes.