Summary
CVE-2026-59801 is a critical missing authentication vulnerability (CWE-306) in 9Router, a Next.js-based AI routing gateway developed by decolua, affecting all versions through 0.4.41. The flaw allows unauthenticated remote attackers to fully interact with provider management and usage API endpoints — enabling theft of plaintext API keys and OAuth tokens, redirection of AI traffic to attacker-controlled servers, exfiltration of conversation histories, and complete denial of service through provider deletion. The vulnerability carries a CVSS 3.1 score of 9.8 (Critical).
Technical details
- Root cause: The Next.js API routes under
src/app/api/providers/*— along with/api/usage/stats,/api/usage/request-logs, and/api/usage/request-details— lack any authentication middleware. All CRUD operations and sensitive data retrieval on these endpoints are accessible without credentials, a session, or any user interaction. - Trigger conditions: Any network-reachable 9Router instance running a vulnerable version; exploitation requires only the ability to send HTTP or HTTPS requests to the application.
- Attack vector: Unauthenticated remote HTTP/HTTPS requests targeting the exposed API endpoints.
- Impact:
- Credential theft: The
/api/usage/statsendpoint returns plaintext API keys for all configured AI providers (e.g., Anthropic Claude, OpenAI GPT, Google Gemini) and associated OAuth tokens — treating them as fully compromised upon exploitation. - Provider manipulation: Attackers can enumerate all configured provider connections, create rogue providers to silently redirect AI traffic to attacker-controlled infrastructure, or modify existing connections to intercept model requests.
- Conversation exfiltration: The
/api/usage/request-logsand/api/usage/request-detailsendpoints expose all users’ complete request histories and conversation contents — including system prompts and model responses — with no authorization check. - Denial of service: Unauthenticated DELETE requests to the providers endpoint can remove all provider configurations, causing a complete outage of AI routing functionality.
- Credential theft: The
Affected software
- 9Router (npm package:
9router, vendor: decolua) — all versions from 0.0.0 through 0.4.41 inclusive
Severity
- CVSS 3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- No patch is currently available. As of July 13, 2026, the vendor has not released a fixed version of 9Router addressing this vulnerability.
- Immediate workarounds:
- Restrict network access: Place 9Router behind a firewall or reverse proxy that enforces IP allowlisting, ensuring only trusted users can reach the dashboard and its API endpoints. Do not expose the application to the public internet.
- Bind to localhost only: If 9Router is not required to serve remote users, ensure it is bound to
127.0.0.1(not0.0.0.0) to prevent any external access. - Take internet-facing instances offline: Any 9Router deployment accessible from the public internet should be taken offline or isolated behind a VPN until a patched release is available.
- Rotate all configured credentials immediately: Treat all AI provider API keys and OAuth tokens stored in any potentially internet-exposed 9Router instance as compromised. Revoke and reissue them through each provider’s respective management console.
- Monitor API access logs: Review logs for unauthorized or unexpected requests to
/api/providers/*and/api/usage/*endpoints to identify potential prior exploitation.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.