Executive brief
9Router, an AI routing and token management tool, contains a security flaw in how it validates Kiro API keys. An authenticated user can trick the system into sending sensitive API keys to a server they control instead of the official Amazon service. This could lead to the theft of AI service credentials and allow an attacker to probe internal network resources that are normally hidden from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router Kiro API-key validation endpoint (`/api/oauth/kiro/api-key`). The application fails to validate the `region` parameter before interpolating it into an upstream URL template (`https://codewhisperer.${region}.amazonaws.com`). An authenticated attacker can inject a crafted region string containing a hostname and a fragment identifier (e.g., `attacker.com#`) to redirect the request to an arbitrary host. Because the application forwards the `Authorization` bearer token to this constructed URL and reflects upstream error messages, an attacker can steal API keys or perform internal network scanning. The vulnerability is addressed in version 0.5.6 by implementing strict region allowlisting and removing upstream response reflection.
Affected products
- decolua 9router < 0.5.6
Timeline
- 2026-06-20: patched: Version 0.5.6 released
- 2026-07-10: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD