Is CVE-2026-56677 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56677 being exploited in the wild.

How severe is CVE-2026-56677?

High severity, with a CVSS score of 8.6, published 17 August 2026.

Which products and versions are affected?

9router (npm) <= 0.5.4, SEMVER:introduced=0,last_affected=0.5.4.

Is there a fix for CVE-2026-56677?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56677 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56677?

Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56677: 9Router unauthenticated server-side request forgery in OIDC test endpoint

Q: Which products and versions are affected?

9router (npm) <= 0.5.4, SEMVER:introduced=0,last_affected=0.5.4.

Q: Is there a fix for CVE-2026-56677?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-56677 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-56677?

Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56677 · Severity: high · CVSS 8.6 · Published 2026-08-17

9Router is a dashboard application that manages OpenID Connect (OIDC) authentication configurations. An attacker can send HTTP requests to an unauthenticated endpoint without logging in, causing the application to make outbound connections to arbitrary internal or external servers specified by the attacker. This allows an attacker to discover internal network topology, scan internal services for open ports, or manipulate how the application processes authentication configuration data—all without valid credentials.

Technologies: 9router (npm). Vendors: npm.

Quick answers

Is CVE-2026-56677 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56677 being exploited in the wild.
How severe is CVE-2026-56677?: High severity, with a CVSS score of 8.6, published 17 August 2026.
Which products and versions are affected?: 9router (npm) <= 0.5.4, SEMVER:introduced=0,last_affected=0.5.4.
Is there a fix for CVE-2026-56677?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56677 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56677?: Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in `src/app/api/auth/oidc/test/route.js`, where the endpoint directly passes the user-supplied `issuerUrl` parameter into a fetch operation (`fetch('${issuerUrl}/.well-known/openid-configuration')`) without DNS-rebinding protection, IP address validation, or authentication checks. An unauthenticated attacker can exploit this in two ways: (1) Blind SSRF via error-based information disclosure by targeting non-JSON services (closed ports, SSH, databases), which triggers parsing failures that leak internal service state through error messages; (2) Full data feed SSRF by targeting internal HTTP services that respond with valid JSON, allowing the attacker to exfiltrate or manipulate OpenID configuration properties. The attack vector is network-based with no authentication required, and can access loopback addresses (127.0.0.1, ::1) and private ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12). The advisory indicates no patch is currently available.

Affected products

decolua 9Router <= 0.5.4

Identifiers

CVE-2026-56677
GHSA-8g4w-4ffg-8vgx

Timeline

2026-07-16: disclosed: GitHub Advisory published
2026-08-17: advisory: Advisory updated on GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.