CVE-2026-56679

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.4

Description An authenticated user can modify security-critical settings because the PATCH '/api/settings' endpoint writes the entire request body to persistent settings without using a field whitelist. By manipulating fields such as requireLogin, an attacker can disable authentication for the entire application, granting unauthenticated access to protected routes including '/api/keys' and '/api/providers'.

Recommendations Update to version 0.5.4.