Authentication Bypass in 9router Public LLM API

9router versions 0.5.4 and earlier contain a critical authentication bypass vulnerability (CVE-2026-56681) within the public LLM API layer. The application improperly trusts the user-supplied 'X-9r-Real-Ip' HTTP header to determine if a request originates from the local host (localhost). Under default deployment modes where the intended 'custom-server.js' security wrapper is absent, the application fails to strip or sanitize this header from inbound client traffic. A remote, unauthenticated attacker can inject 'X-9r-Real-Ip: 127.0.0.1' into HTTP requests to 'isLocalRequest()', which then instructs 'canAccessPublicLlmApi()' to waive mandatory API key validation. This vulnerability permits unauthorized access to the LLM provider resources configured by the instance owner, potentially leading to significant financial loss and account abuse.

Attack Chain

1. Attacker identifies a target 9router instance exposed via port 80/443 without the custom-server.js wrapper.
2. Attacker crafts an HTTP GET request to a protected endpoint, such as '/api/v1/models'.
3. Attacker adds the header 'X-9r-Real-Ip: 127.0.0.1' to the HTTP request.
4. The 9router application receives the request and executes 'isLocalRequest()' in 'src/dashboardGuard.js'.
5. The application erroneously reads the spoofed header value and returns 'true' for local origin validation.
6. The logic proceeds to 'canAccessPublicLlmApi()', which identifies the request as 'local' and skips API key authentication.
7. The application returns '200 OK', granting the attacker access to the model catalog and provider proxy.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass API key enforcement on the public LLM API. Impact includes the unauthorized consumption of the instance owner's paid LLM API credits, unauthorized access to configured provider infrastructure, enumeration of private model configurations, and potential abuse of upstream LLM provider accounts.

Recommendation

• Upgrade 9router to a version that implements secure transport-level source validation, or ensure deployment uses the required 'custom-server.js' wrapper to sanitize headers.
• Implement a web application firewall (WAF) rule to block or strip the 'X-9r-Real-Ip' header from any incoming public traffic.
• Deploy the Sigma rule below to detect attempts to access the '/api/v1/' path with the malicious header present in web server logs.
• Audit current environment configurations to ensure 'custom-server.js' is correctly protecting all public-facing instances.