p PatchFirst

CVE-2026-56677

CVE-2026-56677 · 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

This page contains facts from public vulnerability sources. Check the original advisory before updating.

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

CVSS 8.6 · High · EPSS 0.4%

Published
Updated

Stack: node

Affected products and versions

  • 9router

    Versions
    • <= 0.5.4: Affected

    No fix published

  • 9router npm

    Affected ranges
    • SEMVER: ≤ 0.5.4

    No fix published

Original sources

Check your server →