CVE-2026-56677

Name of the Vulnerable Software and Affected Versions 9Router versions 0.5.4 and earlier

Description A Server-Side Request Forgery (SSRF) exists in the dashboard via the POST '/api/auth/oidc/test' endpoint. The application accepts a user-controlled issuerUrl parameter and passes it to the fetchOidcDiscovery() function without validating if the destination is a restricted internal network or loopback address. When dashboard login is disabled, unauthenticated attackers can use this to scan internal services and reflect OIDC discovery fields, such as token endpoint and jwks uri. This allows for internal network reconnaissance by observing application behavior changes when probing different ports or by retrieving data from internal services that respond with valid OpenID configuration structures.

Recommendations Update 9Router to a version later than 0.5.4. Protect the '/api/auth/oidc/test' endpoint with authentication middleware to require valid user sessions. Validate that the issuerUrl parameter strictly uses the https:// protocol. Implement network blocklists to resolve the hostname in issuerUrl and drop requests pointing to loopback addresses (127.0.0.0/8, ::1) or private internal addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).