decolua 9Router up to 0.5.5 Login Limiter loginLimiter.js getClientIp/checkLock/recordFail X-9r-Real-Ip access control

Summaryinfo

A vulnerability was found in decolua 9Router up to 0.5.5. It has been rated as problematic. This impacts the function getClientIp/checkLock/recordFail of the file src/lib/auth/loginLimiter.js of the component Login Limiter. The manipulation of the argument X-9r-Real-Ip leads to access control. This vulnerability is uniquely identified as CVE-2026-56682. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in decolua 9Router up to 0.5.5. It has been rated as problematic. This issue affects the function getClientIp/checkLock/recordFail of the file src/lib/auth/loginLimiter.js of the component Login Limiter. The manipulation of the argument X-9r-Real-Ip with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. The summary by CVE is:

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-56682 since 06/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 0.5.6 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• decolua

Name

• 9Router

Version

• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3
• 0.5.4
• 0.5.5

Website

• Product: https://github.com/decolua/9router/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion