{"uuid": "b47d67e1-35f7-41d1-ae9f-8a528deb1694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56682", "type": "seen", "source": "https://gist.github.com/alon710/cfe610105c4dec5cb69ce6f35d82ab7c", "content": "# CVE-2026-56682: CVE-2026-56682: Rate Limiter Lockout Bypass via Header Spoofing in 9Router\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56682\n\n## Summary\nA rate limiting bypass vulnerability in 9Router versions before 0.5.6 allows unauthenticated remote attackers to circumvent the login progressive lockout mechanism. By manipulating the client-supplied X-9r-Real-Ip HTTP header, an attacker can rotate the tracking IP address, enabling unthrottled brute-force password guessing against the administrative interface.\n\n## TL;DR\nA login lockout bypass in 9Router < 0.5.6 allows remote attackers to conduct unthrottled brute-force attacks against administrative credentials by spoofing the X-9r-Real-Ip HTTP header.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-307 / CWE-807\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- 9Router versions < 0.5.6\n- **9Router**: < 0.5.6 (Fixed in: `0.5.6`)\n\n## Mitigation\n\n- Upgrade 9Router to version 0.5.6 or later\n- Configure Next.js to bind exclusively to local loopback interface\n- Strip proxy headers at the perimeter/upstream reverse proxy\n\n**Remediation Steps:**\n1. Step 1: Pull the latest Docker image or source code for 9Router v0.5.6 or higher.\n2. Step 2: Update configuration files to bind the internal Next.js server to 127.0.0.1 instead of 0.0.0.0.\n3. Step 3: If utilizing a reverse proxy such as Nginx, configure the configuration blocks to strip 'X-9r-Real-Ip' and 'X-Forwarded-For' headers supplied by untrusted clients.\n4. Step 4: Restart the 9Router service and verify rate limiter enforcement by executing consecutive failed authentication requests using different headers.\n\n## References\n\n- [GitHub Security Advisory GHSA-32gc-64m7-hj7v](https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v)\n- [9Router Fix Commit efd20be8](https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3)\n- [9Router Release v0.5.6](https://github.com/decolua/9router/releases/tag/v0.5.6)\n- [CVE-2026-56682 Record](https://www.cve.org/CVERecord?id=CVE-2026-56682)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56682) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T17:31:57.790121Z"}