Authentication Bypass in 9router via Mass Assignment

9router versions 0.5.2 and earlier contain a mass assignment vulnerability (CVE-2026-56679) within the PATCH /api/settings endpoint. The application fails to whitelist fields provided in the request body, allowing arbitrary fields to be written to the database. An authenticated attacker can specifically target the requireLogin field, setting it to false. Because the dashboardGuard.js middleware uses this setting to determine authentication status, disabling it effectively removes the authentication requirement for the entire application. This exposes sensitive endpoints like /api/keys and /api/providers to unauthenticated access, potentially leading to total system compromise when combined with known default credentials or previously obtained session tokens.

Attack Chain

1. Attacker authenticates to the target 9router instance using a valid session or default credentials (e.g., password '123456').
2. Attacker crafts an HTTP PATCH request to the /api/settings endpoint.
3. Attacker includes {"requireLogin": false} in the JSON request body to trigger the mass assignment vulnerability.
4. The PATCH handler in src/app/api/settings/route.js accepts the input without validation and passes it to the updateSettings repository function.
5. The updateSettings function in src/lib/db/repos/settingsRepo.js performs a partial update, overwriting the stored requireLogin configuration in the database.
6. The dashboardGuard.js middleware observes the updated requireLogin setting and returns true for isAuthenticated checks for all subsequent requests.
7. Attacker performs unauthorized GET requests to sensitive endpoints such as /api/keys without providing credentials to exfiltrate API keys and configuration.

Impact

Successful exploitation allows an authenticated user to achieve global authentication bypass. This results in the exposure of stored API keys, provider connection details, and dashboard administrative settings. The impact is elevated if the instance is exposed via a tunnel (tunnelDashboardAccess enabled), providing a remote vector for full system compromise.

Recommendation

1. Upgrade 9router to a version beyond 0.5.2 immediately.
2. Audit PATCH /api/settings logs for requests containing unexpected keys, specifically focusing on requireLogin, tunnelDashboardAccess, and authMode.
3. Enforce re-authentication for all requests modifying security-critical settings by requiring current password validation at the application level.
4. Deploy network-level access controls to restrict access to the /api path until the patch is applied.