CyberRota Analysis
AI-GeneratedThe vulnerability affects 9Router versions 0.2.21 to 0.4.44, where a hardcoded fallback JWT secret allows attackers to forge authentication tokens if the JWT_SECRET is not set. This critical flaw (CVSS 9.8) can lead to unauthorized access and potential compromise of user sessions. Organizations using affected versions should prioritize immediate updates to version 0.4.44 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44