Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-598019Router 0.4.41 - Unauthenticated API Exposure via /api/providers

Critical 9.8

In plain English

A critical-severity missing authentication in 9Router from decolua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.6%top 14.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	9router	no fix listed	GHSA-vjc7-jrh9-9j86

Affected products (as reported)

Vendor	Product	Versions
decolua	9Router	0 – through 0.4.41

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-vjc7-jrh9-9j86) vendor-advisory
VulnCheck Advisory: 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers third-party-advisory