CVE-2026-56677: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including tokenendpoint and jwksuri.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
9Routerto a version that resolves this vulnerability.Fixed in 0.5.4 - Configuration
Modify handling of the user-controlled issuerUrl parameter for POST /api/auth/oidc/test so fetchOidcDiscovery() only allows safe public OIDC issuer URLs and blocks private/loopback targets.
9Router (OIDC test endpoint) issuerUrl destination restrictions = deny private and loopback destinations - Compensating control
Restrict outbound network access from the service hosting 9Router so it cannot reach private/loopback destinations via requests triggered by the OIDC test functionality (POST /api/auth/oidc/test -> fetchOidcDiscovery()).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56677?
CVE-2026-56677 has a high severity score of 8.6.
How do I fix CVE-2026-56677?
To fix CVE-2026-56677, update your 9Router software to version 0.5.5 or later.
What type of vulnerability is CVE-2026-56677?
CVE-2026-56677 is an Authenticated Server-Side Request Forgery (SSRF) vulnerability.
What is affected by CVE-2026-56677?
CVE-2026-56677 affects 9Router versions 0.5.4 and earlier.
What are the potential impacts of CVE-2026-56677?
Exploitation of CVE-2026-56677 could allow attackers to access internal resources through unprotected endpoints.