CVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.

Notably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.

Depending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:

1. Port Scanning / Blind SSRF (Non-OIDC structures): Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like "Unexpected token..."), allowing internal network reconnaissance.
2. Full Data Feed Manipulation (OIDC matching structures): If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.

Vulnerable Code Details

• Classification: VE-Class 4 — OIDC SSRF via issuerUrl (Unauthenticated)
• File Path: src/app/api/auth/oidc/test/route.js
• Vulnerable Logic: The endpoint accepts the parameter directly from the client request and passes it directly into the network client routine without prior sanitization or middleware authentication wrapper checks.

// Vulnerable implementation wrapper inside the route handler
const discovery = await fetchOidcDiscovery(issuerUrl);
// Behind the scenes, this executes a direct dynamic outbound request:
// -> fetch(`${issuerUrl}/.well-known/openid-configuration`)

An unauthenticated user can point this at any internal URL to probe internal services that respond with JSON. The discovery JSON fields (token_endpoint, jwks_uri) are then processed by the internal application logic for further operations, enabling a multi-step SSRF chain.

Affected Endpoints

• Endpoint: /api/auth/oidc/test
• Method: POST
• Parameter: issuerUrl
• Impacted Feature: OIDC Authentication Configuration Test

Impact

An unauthenticated attacker can abuse this behavior to use the 9Router instance as a proxy to:

• Conduct internal network topology discovery and port scanning against the hosting infrastructure (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16).
• Expose internal application error states or feed malicious configuration structures back into the dashboard component logic without needing prior valid session tokens.

Proof of Concept & Reproducing Steps

Step 1: Set up the Verification Environment

Utilize a local mock listener on an internal port (e.g., Port 80).

Run the following PowerShell script with Administrative privileges to launch the mock listener:

$port = 80
$listener = New-Object System.Net.HttpListener
$listener.Prefixes.Add("http://127.0.0.1:$port/")

try {
    $listener.Start()
    Write-Host "=======================================================" -ForegroundColor Cyan
    Write-Host "  MOCK OIDC SERVER RUNNING ON PORT 80" -ForegroundColor Green
    Write-Host "=======================================================" -ForegroundColor Cyan

    while ($listener.IsListening) {
        $context = $listener.GetContext()
        $request = $context.Request
        Write-Host "[+] SSRF Request received for URL: $($request.Url)" -ForegroundColor Yellow
        
        $jsonPayload =…

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.

Notably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.

Depending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:

1. Port Scanning / Blind SSRF (Non-OIDC structures): Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like "Unexpected token..."), allowing internal network reconnaissance.
2. Full Data Feed Manipulation (OIDC matching structures): If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.

Vulnerable Code Details

• Classification: VE-Class 4 — OIDC SSRF via issuerUrl (Unauthenticated)
• File Path: src/app/api/auth/oidc/test/route.js
• Vulnerable Logic: The endpoint accepts the parameter directly from the client request and passes it directly into the network client routine without prior sanitization or middleware authentication wrapper checks.

// Vulnerable implementation wrapper inside the route handler
const discovery = await fetchOidcDiscovery(issuerUrl);
// Behind the scenes, this executes a direct dynamic outbound request:
// -> fetch(`${issuerUrl}/.well-known/openid-configuration`)

An unauthenticated user can point this at any internal URL to probe internal services that respond with JSON. The discovery JSON fields (token_endpoint, jwks_uri) are then processed by the internal application logic for further operations, enabling a multi-step SSRF chain.

Affected Endpoints

• Endpoint: /api/auth/oidc/test
• Method: POST
• Parameter: issuerUrl
• Impacted Feature: OIDC Authentication Configuration Test

Impact

An unauthenticated attacker can abuse this behavior to use the 9Router instance as a proxy to:

• Conduct internal network topology discovery and port scanning against the hosting infrastructure (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16).
• Expose internal application error states or feed malicious configuration structures back into the dashboard component logic without needing prior valid session tokens.

Proof of Concept & Reproducing Steps

Step 1: Set up the Verification Environment

Utilize a local mock listener on an internal port (e.g., Port 80).

Run the following PowerShell script with Administrative privileges to launch the mock listener:

$port = 80
$listener = New-Object System.Net.HttpListener
$listener.Prefixes.Add("http://127.0.0.1:$port/")

try {
    $listener.Start()
    Write-Host "=======================================================" -ForegroundColor Cyan
    Write-Host "  MOCK OIDC SERVER RUNNING ON PORT 80" -ForegroundColor Green
    Write-Host "=======================================================" -ForegroundColor Cyan

    while ($listener.IsListening) {
        $context = $listener.GetContext()
        $request = $context.Request
        Write-Host "[+] SSRF Request received for URL: $($request.Url)" -ForegroundColor Yellow
        
        $jsonPayload =…