CVE-2026-59801: 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
9Routerto a version that resolves this vulnerability.Fixed in 0.4.41
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59801?
The severity of CVE-2026-59801 is classified as critical with a score of 9.8.
What vulnerability does CVE-2026-59801 address?
CVE-2026-59801 addresses an unauthenticated access vulnerability in 9Router versions up to 0.4.41 that allows remote attackers to exploit provider management API endpoints.
How do I fix CVE-2026-59801?
To fix CVE-2026-59801, upgrade to the latest version of 9Router that includes the necessary authentication middleware.
Which versions of 9Router are affected by CVE-2026-59801?
CVE-2026-59801 affects 9Router versions prior to 0.4.41.
What can attackers do with CVE-2026-59801?
Attackers can remotely interact with sensitive provider management API endpoints without needing any authentication credentials.