CyberRota Analysis
AI-GeneratedThe vulnerability affects 9Router versions prior to 0.5.2, where loopback requests are incorrectly treated as trusted, allowing unauthenticated remote attackers to access sensitive /v1 APIs without an API key. This misclassification can lead to unauthorized access to backend services and potential abuse of upstream provider credentials. Organizations using affected versions of 9Router should prioritize upgrading to version 0.5.2 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.