CVE-2026-59801

Critical

Description

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.

SeverityCritical

CVSS9.8

Exploit probability—

Product9router

PublishedJul 13, 2026

First seenJul 13, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Vendor advisories

github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86

Affected products

Product	Affected versions	Fixed in
9routernpm	v ≤ 0.4.41	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.