CVE-2026-59801

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.42

Description An unauthenticated access issue exists due to missing authentication middleware in the Next.js API routes located under src/app/api/providers/*. This allows remote attackers to interact with provider management API endpoints without credentials. Exploitation enables the enumeration, creation, modification, or deletion of provider connections, which can lead to the exposure of partial credentials, OAuth tokens, and API keys. Additionally, attackers could redirect AI traffic to servers under their control or cause a complete denial of service by deleting all provider connections.

Recommendations Update 9Router to version 0.4.42 or later. Restrict access to the src/app/api/providers/* API endpoints as a temporary mitigation measure.