CVE-2026-55501

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.80

Description The dashboard login rate limiter derives client identity from the X-Forwarded-For HTTP header, which is controlled by the user. When the application is directly exposed or deployed behind a reverse proxy that does not overwrite untrusted forwarding headers, a remote attacker can rotate the X-Forwarded-For value on each login attempt. This allows the attacker to receive a fresh rate-limit bucket for every request, bypassing the 5-attempt threshold and progressive lockout durations. Consequently, an attacker can perform unlimited brute-force attempts against the dashboard password via the /api/auth/login endpoint. The issue involves the getClientIp() function in src/lib/auth/loginLimiter.js and the use of the resulting spoofable value by checkLock() and recordFail() in src/app/api/auth/login/route.js.

Recommendations Update to version 0.4.80. As a temporary workaround, restrict access to the /api/auth/login endpoint or ensure the application is behind a reverse proxy that strips or overwrites the X-Forwarded-For header from untrusted sources.