SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-49352

CRITICAL · CVSS 9.8 EPSS 0.44% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-15 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The vulnerability affects 9Router versions 0.2.21 to 0.4.44, where a hardcoded fallback JWT secret allows attackers to forge authentication tokens if the JWT_SECRET is not set. This critical flaw (CVSS 9.8) can lead to unauthorized access and potential compromise of user sessions. Organizations using affected versions should prioritize immediate updates to version 0.4.44 to mitigate the risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49352
Severity
CRITICAL
CVSS
9.8
EPSS
0.44%

Original NVD Description

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44