DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-56677: CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint

#security #cve #cybersecurity

CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint

Vulnerability ID: CVE-2026-56677
CVSS Score: 8.6
Published: 2026-08-17

A high-severity security vulnerability exists in 9Router, an AI router and token saver dashboard. When dashboard authentication features are disabled or left in default configurations, the application exposes administrative testing routines directly to the public internet. Unauthenticated network adversaries can exploit the OIDC configuration validation endpoint to initiate arbitrary HTTP requests, routing unauthorized traffic to local loops, adjacent container ports, and cloud resource metadata interfaces.

TL;DR

Unauthenticated network attackers can exploit a testing endpoint in 9Router (<= 0.5.4) to execute Server-Side Request Forgery (SSRF), gaining unauthorized access to internal services and cloud instance metadata.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918, CWE-306
  • Attack Vector: Network (AV:N)
  • CVSS: 8.6 (High)
  • EPSS Score: N/A
  • Impact: High Integrity, Low Confidentiality, Low Availability
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • 9Router AI dashboard platforms running version 0.5.4 or earlier
  • 9router: <= 0.5.4 (Fixed in: Verify config changes (Require API key ON))

Mitigation Strategies

  • Ensure that 'Require API key' is toggled to ON in the dashboard settings
  • Implement DNS lookup validation before issuing outbound network connections to user-controlled URLs
  • Restrict container egress traffic to block outbound calls to localhost, RFC 1918 subnets, and cloud metadata blocks

Remediation Steps:

  1. Log in to the 9Router administrative dashboard
  2. Go to the Endpoint & Key configurations panel
  3. Enable the 'Require API key' option to block unauthenticated access
  4. Deploy egress network security rules in your firewall or VPC to isolate outbound calls

References

Read the full report for CVE-2026-56677 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)