Executive brief
9Router is a popular open-source tool that provides a dashboard login interface for managing API proxy and provider settings. The login endpoint enforces rate-limiting to prevent brute-force password guessing, but this protection can be completely bypassed by manipulating a request header. An attacker can make unlimited login attempts from a single network location by rotating the spoofed header value, allowing them to recover the dashboard password and gain administrative access to all API endpoints and provider configurations.
Technical details
The vulnerability is a brute-force protection bypass (CWE-307, CWE-807) in the login rate-limiter. The getClientIp() function in src/lib/auth/loginLimiter.js reads the client IP directly from the X-9r-Real-Ip HTTP header instead of the transport-layer socket address. While the design assumes this header is set only by a trusted custom-server.js wrapper, in deployment modes where Next.js is accessed directly (not through the wrapper), the attacker controls this header. Since the lockout mechanism is per-IP bucket and each distinct header value creates a new bucket, rotating the header value with each password guess keeps every counter below the 5-attempt threshold, bypassing the 30+ second lockout (HTTP 429). Exploitation requires network access to the login endpoint (default bind 0.0.0.0); no authentication or user interaction is needed. A recovered password grants full administrative access to the 9Router dashboard and its APIs. The issue is fixed in version 0.5.8 by deriving the rate-limit key from req.socket.remoteAddress instead of the header.
Affected products
- decolua 9Router 0.5.4 and earlier; fixed in 0.5.8
Timeline
- 2026-09-22: disclosed: GHSA-32gc-64m7-hj7v published on GitHub Security Advisory database
- 2026-09-22: patched: Fix released in 9Router version 0.5.8 (commit efd20be8d81ef2e256a7037f3aa78e6b567b5fd3)