https://vulnerability.circl.lu/sightings/feed 2026-09-28T13:44:37.634908+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/80939fad-e8ea-4f65-ae37-851ddc33e54b/export 2026-09-28T13:44:37.663489+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "80939fad-e8ea-4f65-ae37-851ddc33e54b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56681", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-56681.yaml", "content": "", "creation_timestamp": "2026-09-23T02:58:05.000000Z"} 2026-09-23T02:58:05+00:00 https://vulnerability.circl.lu/sighting/92255f27-0a13-4d4e-bc5b-b7df7984b49e/export 2026-09-28T13:44:37.666116+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "92255f27-0a13-4d4e-bc5b-b7df7984b49e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-56681", "type": "published-proof-of-concept", "source": "https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8", "content": "", "creation_timestamp": "2026-09-22T18:35:06.089216Z"} 2026-09-22T18:35:06.089216+00:00 https://vulnerability.circl.lu/sighting/7d30a0cf-1217-492a-b691-9a9cccf06fd4/export 2026-09-28T13:44:37.668250+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "7d30a0cf-1217-492a-b691-9a9cccf06fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56681", "type": "seen", "source": "https://gist.github.com/alon710/bf3a865551bb5c97cbf5b48608ac9014", "content": "# CVE-2026-56681: CVE-2026-56681: Authentication Bypass via HTTP Header Spoofing in 9Router\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56681\n\n## Summary\nCVE-2026-56681 is a high-severity authentication bypass vulnerability in 9Router, an AI router and token-saving proxy. The vulnerability arises from an improper trust boundary where the application relies on the client-controlled HTTP header X-9r-Real-Ip to determine whether an incoming request originates from a local (loopback) environment. In deployments where requests can reach the Next.js backend directly\u2014bypassing the sanitizing custom-server.js wrapper\u2014a remote, unauthenticated attacker can spoof their origin by supplying an X-9r-Real-Ip: 127.0.0.1 header.\n\n## TL;DR\nAn authentication bypass in 9Router allows remote attackers to spoof their IP address via the X-9r-Real-Ip header and access sensitive APIs without validation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-807\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.3\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: No\n- **Impact**: Authentication Bypass / Unauthorized Resource Consumption\n\n## Affected Systems\n\n- 9Router (decolua/9router)\n- **9Router**: < 0.5.6 (Fixed in: `0.5.6`)\n\n## Mitigation\n\n- Upgrade 9Router to version 0.5.6 or higher to ensure the custom-server.js patch is applied.\n- Ensure the application is executed through custom-server.js and never via next start directly.\n- Configure upstream reverse proxies (Nginx, Cloudflare, Traefik) to strip all X-9r-Real-Ip headers from client requests.\n\n**Remediation Steps:**\n1. Step 1: Check your package.json or container definition to ensure you are pulling 9router version >= 0.5.6.\n2. Step 2: Verify the startup command is utilizing node custom-server.js instead of direct next-cli executions.\n3. Step 3: Update your edge proxy configuration to explicitly drop untrusted custom headers before routing to 9Router.\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-56681)\n- [GitHub Security Advisory](https://github.com/decolua/9router/security/advisories/GHSA-5mj8-gf6m-fhw8)\n- [Fix Commit (9Router Repository)](https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3)\n- [Release v0.5.6 (9Router Tag)](https://github.com/decolua/9router/releases/tag/v0.5.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56681) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T18:32:29.135213Z"} 2026-09-22T18:32:29.135213+00:00