Unauthenticated SSRF in 9Router OIDC Test Endpoint

9Router versions 0.5.4 and earlier are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the /api/auth/oidc/test endpoint. The vulnerability exists because the application accepts a user-controlled 'issuerUrl' parameter and performs an unauthenticated outbound HTTP request to the provided URL without validating the destination. An attacker can force the application to probe internal network infrastructure, including loopback addresses and private IP subnets.

The impact varies based on the target internal service: if the target is a non-HTTP service, the application leaks error details that confirm internal port accessibility. If the target responds with a JSON structure matching the OIDC configuration schema, the application parses the response and reflects its contents to the requester. This vulnerability, tracked as CVE-2026-56677, requires no authentication, making it a highly accessible vector for internal reconnaissance and potential configuration manipulation within the hosting environment.

Attack Chain

1. Attacker identifies a 9Router instance reachable via the network.
2. Attacker crafts an HTTP POST request targeting the /api/auth/oidc/test endpoint.
3. Attacker populates the 'issuerUrl' JSON field with a target internal IP address or hostname (e.g., http://127.0.0.1:80).
4. 9Router backend receives the request and, lacking authentication middleware, initiates an outbound 'fetch' request to the specified 'issuerUrl'.
5. The target internal resource receives the request and returns a response (either an error, a raw string, or a valid OIDC JSON configuration).
6. 9Router parses the response; if it matches an OIDC schema, internal metadata is processed and stored by the backend.
7. 9Router reflects the parsed data or error message back to the attacker in the HTTP response body.
8. Attacker uses this feedback loop to map internal network topology or exfiltrate internal configuration data.

Impact

The vulnerability allows unauthenticated attackers to conduct internal network reconnaissance and perform blind or reflected SSRF attacks. Successful exploitation enables an attacker to map internal services and potentially manipulate the internal application state by feeding spoofed OIDC discovery documents into the system.

Recommendation

• Upgrade 9Router to a version containing the patch for CVE-2026-56677.
• Apply authentication middleware to the /api/auth/oidc/test endpoint to ensure only authorized users can trigger outbound requests.
• Implement a network allowlist or blocklist in the application logic to prevent requests to local loopback (127.0.0.0/8) and private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) IP address ranges.
• Validate that the 'issuerUrl' strictly adheres to the 'https://' protocol scheme to prevent protocol smuggling.
• Monitor webserver access logs for anomalous POST requests to the /api/auth/oidc/test endpoint, specifically those originating from external IP addresses.