Executive brief
decolua 9router is an AI routing tool used to manage and optimize connections to various AI model providers. A security flaw in the dashboard's authentication logic allows remote attackers to bypass security checks by manipulating network headers. This could lead to unauthorized access to sensitive internal data, including API keys and system settings, potentially compromising the integrity of the AI services being managed.
Technical details
An improper authorization vulnerability exists in decolua 9router versions up to 0.4.0 within the `isAuthenticated` function of `src/dashboardGuard.js`. The root cause is a logic flaw where the application relies on the user-controllable HTTP 'Host' header to determine if a request is coming from a trusted local source. A remote attacker with low privileges can manipulate this header to bypass the dashboard's authentication mechanisms. Successful exploitation grants unauthorized access to sensitive internal API endpoints such as `/api/keys` and `/api/settings`. The issue is further exacerbated by a Next.js middleware misconfiguration that failed to properly enforce security guards. This has been addressed in version 0.4.1 by implementing stricter CLI token validation and correcting the middleware configuration.
Affected products
- decolua 9router up to 0.4.0
Timeline
- 2026-04-23: disclosed: Issue reported on GitHub and patch released
- 2026-04-23: patched: Version 0.4.1 released with security hardening
- 2026-06-01: advisory: CVE-2026-10269 published
References
- https://github.com/decolua/9router/
- https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca
- https://github.com/decolua/9router/issues/742
- https://github.com/decolua/9router/releases/tag/v0.4.1
- https://vuldb.com/cve/CVE-2026-10269
- https://vuldb.com/submit/825188
- https://vuldb.com/vuln/367548