CyberRota Analysis
AI-GeneratedThe vulnerability in 9Router allows unauthenticated users to export and import the entire database, exposing sensitive information such as credentials, API keys, and OAuth tokens. This critical flaw poses a significant risk to any organization using versions prior to 0.4.80, as it could lead to unauthorized access and data breaches. Organizations utilizing this AI router should prioritize updating to version 0.4.80 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.