| शीर्षक | decolua 9router 0.5.55 Authorization Bypass |
|---|
| विवरण | A vulnerability has been found in 9Router (an open-source local AI routing gateway, npm packages 9router/9router-app), up to version 0.5.55. The vulnerability exists because the middleware's (src/dashboardGuard.js) API-Key guarded list (PUBLIC_PREFIXES) does not include the /responses path, while next.config.mjs rewrites this path to the chat handler at /api/v1/responses. Since Next.js middleware executes before URL rewriting, an attacker with no API key can access the /responses endpoint, which is then dispatched to the full chat pipeline (model resolution, account selection, upstream executor dispatch). Combined with the project's default configuration (REQUIRE_API_KEY=false as recommended in .env.example), the gateway becomes completely accessible without any credentials, allowing attackers to consume quota/costs from all configured upstream LLM accounts and potentially exfiltrate request data. Additionally, due to Next.js path segment normalization, variants such as /v1/../responses can also bypass the middleware. |
|---|
| स्रोत | ⚠️ https://github.com/decolua/9router/issues/3677 |
|---|
| उपयोगकर्ता | CAPT (UID 100253) |
|---|
| सबमिशन | 01/09/2026 07:17 AM (1 महीना पहले) |
|---|
| संयम | 29/09/2026 08:32 PM (29 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 377538 [decolua 9router तक 0.5.1 Codex Request next.config.mjs कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|