CVE-2026-56681: 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/ routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
9Routerto a version that resolves this vulnerability.Fixed in 0.5.6
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running versions before 0.5.6 are exposed if requests can reach Next.js without passing through the sanitizing custom-server.js wrapper. The issue affects public /api/v1/* routes where the client-controlled X-9r-Real-Ip header is trusted.
What does an attacker need to exploit this issue?
An attacker needs only network access to the affected 9Router instance. They can send an unauthenticated request with X-9r-Real-Ip set to 127.0.0.1 to be treated as a local client.
How can I check whether exploitation is possible?
Verify whether the deployment is older than 0.5.6 and whether any request path bypasses the sanitizing custom-server.js wrapper before reaching Next.js. A request to GET /api/v1/models with a spoofed X-9r-Real-Ip header can be used to assess whether API-key validation is skipped.
What should I do if I cannot upgrade immediately?
Ensure all requests are routed through the sanitizing custom-server.js wrapper so client-supplied X-9r-Real-Ip values cannot reach Next.js unsanitized. Upgrade to version 0.5.6 when possible.