Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M

CVE-2026-566779Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

High 8.6

In plain English

A high-severity missing authentication in 9router from decolua. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.4%top 68.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	9router	no fix listed	GHSA-8g4w-4ffg-8vgx

Affected products (as reported)

Vendor	Product	Versions
decolua	9router	<= 0.5.4

Weakness: CWE-306, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx x_refsource_CONFIRM