CVE-2026-62327

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.42

Description An unauthenticated information disclosure issue exists where remote attackers can retrieve plaintext API keys for all connected AI provider accounts. This occurs due to missing authentication middleware on the Next.js API route at the '/api/usage/stats' endpoint. Exploitation allows the retrieval of full API key strings, token counts, cost breakdowns, and request metadata, which can lead to unauthorized account usage, billing fraud, and quota exhaustion.

Recommendations Update 9Router to version 0.4.42 or later. As a temporary mitigation, restrict access to the '/api/usage/stats' endpoint.