Executive brief
9Router, an AI routing and token management tool, contains a security flaw where it uses a publicly known, hardcoded password to secure user sessions if a custom secret is not configured by the administrator. This allows an attacker to easily create their own login credentials and gain full administrative access to the router's dashboard. Once inside, an attacker can steal sensitive API keys, modify system settings, or shut down the service entirely.
Technical details
9Router (versions 0.2.21 through 0.4.43) implements a hardcoded fallback string ('9router-default-secret-change-me') for signing JSON Web Tokens (JWT) used in dashboard sessions. This occurs in src/app/api/auth/login/route.js and src/middleware.js (and later src/lib/auth/dashboardSession.js) whenever the JWT_SECRET environment variable is not explicitly defined by the user. A remote, unauthenticated attacker can use this publicly known secret to sign a forged 'auth_token' cookie. By presenting this forged cookie, the attacker achieves a complete authentication bypass, granting them full access to the dashboard and API, including the ability to extract stored API keys and database credentials. The issue is resolved in version 0.4.44 by removing the fallback and requiring a user-defined secret.
Affected products
- decolua 9Router 0.2.21 to 0.4.43
Timeline
- 2026-01-09: other: Vulnerability introduced in commit 23cfb19
- 2026-05-15: patched: Version 0.4.44 released with fix
- 2026-05-31: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE-2026-49352 published to NVD