9router vulnerabilities (npm)
19 vulnerabilities.
-
9routernpm 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header 5.3 Medium -
9routernpm 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header 7.3 High -
9routernpm 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint 8.6 High -
9routernpm 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding 6.4 Medium -
9routernpm 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade 8.7 High -
9routernpm 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs 8.3 High -
9routernpm 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass 8.6 High -
9routernpm 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF 8.2 High -
9routernpm 9router: Image prefetch DNS rebinding allows SSRF to internal services 7.4 High -
9routernpm 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header 7.3 High -
9routernpm 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover 9.9 Critical -
9routernpm 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints 8.7 High -
9routernpm 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats 9.3 Critical -
9routernpm 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers 9.3 Critical -
9routernpm 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING 7.5 High -
9routernpm 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass 9.8 Critical -
9routernpm 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint 9.2 Critical -
9routernpm 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes 10.0 Critical -
9routernpm decolua 9router Administrative API Endpoint api authorization 6.9 Medium