Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

9Router can let logged‑in users redirect validation requests

CVE-2026-56678 · published 3 months ago
Summary

If a user is logged in to 9Router version before 0.5.6, they can change a region setting to point to any host they control. The system then forwards the user’s API key to that host, potentially exposing credentials. Upgrade to version 0.5.6 or later to stop this behavior.

What to do
  • Update 9router to version 0.5.6.
Affected software
Ecosystem VendorProductAffected versions
– decolua 9router < 0.5.6
npm – 9router <= 0.5.2
Fix: upgrade to 0.5.6
Original advisory text
9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published15 Jul 2026
Updated29 Oct 2026
First seen15 Jul 2026
Sources
CVE-2026-56678 · OSV
CVE-2026-56678 · NVD
CVE-2026-56678 · MITRE
GHSA-6mwv-4mrm-5p3m · GHSA
Track software like this
Free during beta