CVE-2026-56682: medium-severity vulnerability in decolua 9router
9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
decolua · 9routerRelated CVEs — decolua 9router
In the same product, most dangerous first.
CVE-2026-55638HIGH9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypassEPSS 6.6%CVE-2026-46339CRITICAL9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routesEPSS 2.8%CVE-2026-59800CRITICAL9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install EndpointEPSS 2.1%CVE-2026-56681HIGH9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip HeaderEPSS 1.1%CVE-2026-63732CRITICAL9router before 0.4.60 Remote Code Execution via default passwordEPSS 1.0%CVE-2026-62312HIGH9Router: Authenticated RCE via Unvalidated MCP Plugin ArgumentsEPSS 0.9%