{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-56677/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-56677"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["9router"],"_cs_severities":["high"],"_cs_tags":["ssrf","cve-2026-56677","9router"],"_cs_type":"advisory","_cs_vendors":["9Router"],"content_html":"\u003cp\u003e9Router versions 0.5.4 and earlier are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the /api/auth/oidc/test endpoint. The vulnerability exists because the application accepts a user-controlled 'issuerUrl' parameter and performs an unauthenticated outbound HTTP request to the provided URL without validating the destination. An attacker can force the application to probe internal network infrastructure, including loopback addresses and private IP subnets.\u003c/p\u003e\n\u003cp\u003eThe impact varies based on the target internal service: if the target is a non-HTTP service, the application leaks error details that confirm internal port accessibility. If the target responds with a JSON structure matching the OIDC configuration schema, the application parses the response and reflects its contents to the requester. This vulnerability, tracked as CVE-2026-56677, requires no authentication, making it a highly accessible vector for internal reconnaissance and potential configuration manipulation within the hosting environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a 9Router instance reachable via the network.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP POST request targeting the /api/auth/oidc/test endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker populates the 'issuerUrl' JSON field with a target internal IP address or hostname (e.g., http://127.0.0.1:80).\u003c/li\u003e\n\u003cli\u003e9Router backend receives the request and, lacking authentication middleware, initiates an outbound 'fetch' request to the specified 'issuerUrl'.\u003c/li\u003e\n\u003cli\u003eThe target internal resource receives the request and returns a response (either an error, a raw string, or a valid OIDC JSON configuration).\u003c/li\u003e\n\u003cli\u003e9Router parses the response; if it matches an OIDC schema, internal metadata is processed and stored by the backend.\u003c/li\u003e\n\u003cli\u003e9Router reflects the parsed data or error message back to the attacker in the HTTP response body.\u003c/li\u003e\n\u003cli\u003eAttacker uses this feedback loop to map internal network topology or exfiltrate internal configuration data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to conduct internal network reconnaissance and perform blind or reflected SSRF attacks. Successful exploitation enables an attacker to map internal services and potentially manipulate the internal application state by feeding spoofed OIDC discovery documents into the system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade 9Router to a version containing the patch for CVE-2026-56677.\u003c/li\u003e\n\u003cli\u003eApply authentication middleware to the /api/auth/oidc/test endpoint to ensure only authorized users can trigger outbound requests.\u003c/li\u003e\n\u003cli\u003eImplement a network allowlist or blocklist in the application logic to prevent requests to local loopback (127.0.0.0/8) and private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) IP address ranges.\u003c/li\u003e\n\u003cli\u003eValidate that the 'issuerUrl' strictly adheres to the 'https://' protocol scheme to prevent protocol smuggling.\u003c/li\u003e\n\u003cli\u003eMonitor webserver access logs for anomalous POST requests to the /api/auth/oidc/test endpoint, specifically those originating from external IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T00:46:30Z","date_published":"2026-08-18T00:46:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-9router-ssrf/","summary":"An unauthenticated SSRF vulnerability in the 9Router /api/auth/oidc/test endpoint allows remote attackers to perform internal network scanning and data exfiltration via the issuerUrl parameter.","title":"Unauthenticated SSRF in 9Router OIDC Test Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-08-9router-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-56677","version":"https://jsonfeed.org/version/1.1"}