decolua 9router up to 0.4.43 JWT Authentication route.js login hard-coded credentials

Summaryinfo

A vulnerability, which was classified as problematic, has been found in decolua 9router up to 0.4.43. This vulnerability affects the function Login of the file src/app/api/auth/login/route.js of the component JWT Authentication. The manipulation leads to hard-coded credentials. This vulnerability is referenced as CVE-2026-49352. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in decolua 9router up to 0.4.43. This issue affects the function login of the file src/app/api/auth/login/route.js of the component JWT Authentication. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality. The summary by CVE is:

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-49352 since 05/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

Upgrading to version 0.4.44 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• decolua

Name

• 9router

Version

• 0.4.0
• 0.4.1
• 0.4.2
• 0.4.3
• 0.4.4
• 0.4.5
• 0.4.6
• 0.4.7
• 0.4.8
• 0.4.9
• 0.4.10
• 0.4.11
• 0.4.12
• 0.4.13
• 0.4.14
• 0.4.15
• 0.4.16
• 0.4.17
• 0.4.18
• 0.4.19
• 0.4.20
• 0.4.21
• 0.4.22
• 0.4.23
• 0.4.24
• 0.4.25
• 0.4.26
• 0.4.27
• 0.4.28
• 0.4.29
• 0.4.30
• 0.4.31
• 0.4.32
• 0.4.33
• 0.4.34
• 0.4.35
• 0.4.36
• 0.4.37
• 0.4.38
• 0.4.39
• 0.4.40
• 0.4.41
• 0.4.42
• 0.4.43

Website

• Product: https://github.com/decolua/9router/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion