Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-566829Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

Medium 5.3

In plain English

A medium-severity security flaw in 9router from decolua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	9router	0.5.8	GHSA-32gc-64m7-hj7v

Affected products (as reported)

Vendor	Product	Versions
decolua	9router	< 0.5.6

Weakness: CWE-307, CWE-807 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v x_refsource_CONFIRM
https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3 x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.5.6 x_refsource_MISC