{"uuid": "7d30a0cf-1217-492a-b691-9a9cccf06fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56681", "type": "seen", "source": "https://gist.github.com/alon710/bf3a865551bb5c97cbf5b48608ac9014", "content": "# CVE-2026-56681: CVE-2026-56681: Authentication Bypass via HTTP Header Spoofing in 9Router\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56681\n\n## Summary\nCVE-2026-56681 is a high-severity authentication bypass vulnerability in 9Router, an AI router and token-saving proxy. The vulnerability arises from an improper trust boundary where the application relies on the client-controlled HTTP header X-9r-Real-Ip to determine whether an incoming request originates from a local (loopback) environment. In deployments where requests can reach the Next.js backend directly\u2014bypassing the sanitizing custom-server.js wrapper\u2014a remote, unauthenticated attacker can spoof their origin by supplying an X-9r-Real-Ip: 127.0.0.1 header.\n\n## TL;DR\nAn authentication bypass in 9Router allows remote attackers to spoof their IP address via the X-9r-Real-Ip header and access sensitive APIs without validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-807\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.3\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: No\n- **Impact**: Authentication Bypass / Unauthorized Resource Consumption\n\n## Affected Systems\n\n- 9Router (decolua/9router)\n- **9Router**: < 0.5.6 (Fixed in: `0.5.6`)\n\n## Mitigation\n\n- Upgrade 9Router to version 0.5.6 or higher to ensure the custom-server.js patch is applied.\n- Ensure the application is executed through custom-server.js and never via next start directly.\n- Configure upstream reverse proxies (Nginx, Cloudflare, Traefik) to strip all X-9r-Real-Ip headers from client requests.\n\n**Remediation Steps:**\n1. Step 1: Check your package.json or container definition to ensure you are pulling 9router version >= 0.5.6.\n2. Step 2: Verify the startup command is utilizing node custom-server.js instead of direct next-cli executions.\n3. Step 3: Update your edge proxy configuration to explicitly drop untrusted custom headers before routing to 9Router.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-56681)\n- [GitHub Security Advisory](https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8)\n- [Fix Commit (9Router Repository)](https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3)\n- [Release v0.5.6 (9Router Tag)](https://github.com/decolua/9router/releases/tag/v0.5.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56681) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T18:32:29.135213Z"}