CVE-2026-56675 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs
Remote attackers can bypass authentication and access APIs by exploiting reverse proxy misclassification of loopback traffic in 9router.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56675?
CVE-2026-56675 is a high-severity authentication bypass vulnerability in decolua 9router, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.
Which versions are affected by CVE-2026-56675?
2 open source packages ship an affected version, including 9router.
| Package | Affected | Fixed in |
|---|---|---|
9router npm | All versions | 0.5.2 |
9router npm | All versions | 0.5.2 |
How do I fix CVE-2026-56675?
Upgrade 9router to 0.5.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-56675 being exploited?
There is no known exploitation of CVE-2026-56675 in the wild and no public exploit code.
Sources
Also known as GHSA-x5c9-v98j-722r.