CVE-2026-56679 | 9Router is an AI router & token saver. Prior to 0.5.4, the P… | CVSS 8.7 HIGH

Description

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.

Metadata

CVE ID: CVE-2026-56679
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-22 16:39 UTC
Published: 2026-07-15 20:50 UTC
Last updated: 2026-07-16 13:00 UTC
Primary CWE: CWE-915
CWE-915: Improperly Controlled Modification of Dynamically-D…
Vendor / Product: decolua / 9router
Sources: cve.org · NVD

Severity & Metrics

8.7 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
decolua	9router	—	< 0.5.4

Weakness (CWE)

CWE	Source	Description
CWE-915	cna	CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References (1)

https://github.com/decolua/9router/security/advisories/GHSA-vmjq-hvgq-2wv4 https://github.com/decolua/9router/security/advisories/GHSA-vmjq-hvgq-2wv4