CVE-2026-55501 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header
Attackers can bypass login rate limits by spoofing the X-Forwarded-For header, enabling unlimited brute-force attacks against dashboard credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55501?
CVE-2026-55501 is a high-severity vulnerability in decolua 9router, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.
Weakness: CWE-307
Which versions are affected by CVE-2026-55501?
2 open source packages ship an affected version, including 9router.
| Package | Affected | Fixed in |
|---|---|---|
9router npm | All versions | 0.4.77 |
9router npm | All versions | 0.4.77 |
How do I fix CVE-2026-55501?
Upgrade 9router to 0.4.77 or later.
Is CVE-2026-55501 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55501 exists.
Sources
Also known as GHSA-7cfm-pqrj-xgq7.