DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-56681: CVE-2026-56681: Authentication Bypass via HTTP Header Spoofing in 9Router

#security #cve #cybersecurity

CVE-2026-56681: Authentication Bypass via HTTP Header Spoofing in 9Router

Vulnerability ID: CVE-2026-56681
CVSS Score: 7.3
Published: 2026-09-22

CVE-2026-56681 is a high-severity authentication bypass vulnerability in 9Router, an AI router and token-saving proxy. The vulnerability arises from an improper trust boundary where the application relies on the client-controlled HTTP header X-9r-Real-Ip to determine whether an incoming request originates from a local (loopback) environment. In deployments where requests can reach the Next.js backend directly—bypassing the sanitizing custom-server.js wrapper—a remote, unauthenticated attacker can spoof their origin by supplying an X-9r-Real-Ip: 127.0.0.1 header.

TL;DR

An authentication bypass in 9Router allows remote attackers to spoof their IP address via the X-9r-Real-Ip header and access sensitive APIs without validation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-807
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.3
  • Exploit Status: Proof of Concept
  • CISA KEV Status: No
  • Impact: Authentication Bypass / Unauthorized Resource Consumption

Affected Systems

  • 9Router (decolua/9router)
  • 9Router: < 0.5.6 (Fixed in: 0.5.6)

Code Analysis

Commit: efd20be

Secure loopback IP trust boundary and strip forwarded proxy headers in custom-server.js wrapper.

Mitigation Strategies

  • Upgrade 9Router to version 0.5.6 or higher to ensure the custom-server.js patch is applied.
  • Ensure the application is executed through custom-server.js and never via next start directly.
  • Configure upstream reverse proxies (Nginx, Cloudflare, Traefik) to strip all X-9r-Real-Ip headers from client requests.

Remediation Steps:

  1. Step 1: Check your package.json or container definition to ensure you are pulling 9router version >= 0.5.6.
  2. Step 2: Verify the startup command is utilizing node custom-server.js instead of direct next-cli executions.
  3. Step 3: Update your edge proxy configuration to explicitly drop untrusted custom headers before routing to 9Router.

References

Read the full report for CVE-2026-56681 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)