# CVE-2026-59801: decolua 9Router missing authentication in management API

Source: https://junglewise.ai/threats/cve-2026-59801-decolua-9router-missing-authentication-in-management-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-59801 · Severity: critical · CVSS 9.8 · Published 2026-07-13

9Router, an AI model routing dashboard, contains a critical security flaw where several management interfaces are completely unprotected. An unauthorized person can access the system over the internet to steal sensitive AI provider API keys, view private conversation histories between users and AI models, or shut down the service entirely. This could lead to the theft of expensive AI resources or the exposure of confidential business data contained in AI prompts.

Technologies: [9router (npm)](https://junglewise.ai/threats/technologies/9router). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-59801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59801 being exploited in the wild.

**How severe is CVE-2026-59801?** Critical severity, with a CVSS score of 9.8, published 13 July 2026.

**Which products and versions are affected?** 9router (npm) SEMVER:introduced=0,last_affected=0.4.41.

**Is there a fix for CVE-2026-59801?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59801 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59801?** Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from missing authentication middleware in several Next.js API routes, specifically under /api/providers/* and /api/usage/*. A remote, unauthenticated attacker can perform CRUD operations on provider connections, allowing them to inject malicious providers to intercept traffic or delete existing ones to cause a denial of service. Additionally, the /api/usage/stats endpoint leaks full plaintext API keys (e.g., OpenAI, Anthropic), and /api/usage/request-details exposes complete conversation logs including system prompts and assistant responses. As of the advisory date, no patched version has been released.

## Affected products

- decolua 9Router <= 0.4.41

## Identifiers

- CVE-2026-59801
- GHSA-vjc7-jrh9-9j86

## Timeline

- 2026-06-13: advisory: Initial GitHub Security Advisory published by vendor
- 2026-07-13: disclosed: CVE published and NVD record created

## References

- [https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86](https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86)
- [https://www.vulncheck.com/advisories/9router-unauthenticated-api-exposure-via-api-providers](https://www.vulncheck.com/advisories/9router-unauthenticated-api-exposure-via-api-providers)

## Related threats

- [9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header](https://junglewise.ai/threats/cve-2026-56682-9router-login-brute-force-lockout-bypass-via-spoofable-header)
- [9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header](https://junglewise.ai/threats/cve-2026-56681-9router-authentication-bypass-in-public-llm-api-via-spoofable-x)
- [9Router unauthenticated server-side request forgery in OIDC test endpoint](https://junglewise.ai/threats/cve-2026-56677-9router-unauthenticated-server-side-request-forgery-in-oidc-test)
- [decolua 9Router mass assignment in /api/settings](https://junglewise.ai/threats/cve-2026-56679-decolua-9router-mass-assignment-in-api-settings)
- [decolua 9router SSRF and credential forwarding in Kiro API validation](https://junglewise.ai/threats/cve-2026-56678-decolua-9router-ssrf-and-credential-forwarding-in-kiro-api)