Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:9router:9router:*:*:*:*:*:*:*:*

2 briefs RSS
high advisory

Authentication Bypass in 9router via Mass Assignment

9router versions 0.5.2 and earlier are vulnerable to mass assignment in the PATCH /api/settings endpoint, allowing an authenticated user to disable authentication globally and access protected API routes.

9router +1 mass-assignment cve authentication-bypass ssrf dns-rebinding
1r 2t 1c
high advisory

9router Authentication Bypass and SSRF via Host Header Spoofing

An authentication bypass in 9router 0.4.80 and earlier allows remote attackers to spoof the 'Host' header, gaining unauthorized access to API proxy endpoints, enabling quota theft via AI relay and server-side request forgery (SSRF).

9router +1 authentication-bypass ssrf api-security web-vulnerability authorization-bypass llm-proxy
2r 2t 1c