CVE-2026-49352

Name of the Vulnerable Software and Affected Versions 9Router versions 0.2.21 through 0.4.43

Description 9Router uses a hardcoded fallback string as the secret for signing JSON Web Tokens (JWT) when the JWT SECRET environment variable is not configured. This allows an unauthenticated remote attacker to forge a valid auth token cookie and gain full access to the dashboard and API. The issue exists in the src/app/api/auth/login/route.js, src/middleware.js, and src/lib/auth/dashboardSession.js files. An attacker can use this to steal API keys, modify settings, or shut down the service. Additionally, this can be used to pivot via the MCP stdio→SSE bridge exposed at the /api/mcp/ endpoint.

Recommendations Update 9Router to version 0.4.44. Ensure the JWT SECRET environment variable is set to a strong, unique value to prevent the application from using the default fallback secret.