CVE-2026-56677: 9Router SSRF Information Disclosure Flaw

CVE-2026-56677 Overview

CVE-2026-56677 is a Server-Side Request Forgery (SSRF) vulnerability in 9Router, an AI router and token saver application. The flaw affects versions 0.5.4 and earlier. The POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js accepts a user-controlled issuerUrl parameter and passes it to fetchOidcDiscovery() in src/lib/auth/oidc.js without validating the destination. When dashboard login is disabled, unauthenticated attackers can probe internal services and receive reflected OpenID Connect (OIDC) discovery fields including token_endpoint and jwks_uri. The issue is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated attackers can scan internal networks and extract OIDC discovery metadata from services reachable by the 9Router host.

Affected Products

9Router versions 0.5.4 and earlier
Deployments where dashboard login is disabled
Instances exposing the /api/auth/oidc/test endpoint to untrusted networks

Discovery Timeline

2026-08-17 - CVE-2026-56677 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-56677

Vulnerability Analysis

The vulnerability resides in the OIDC configuration testing endpoint. The handler in src/app/api/auth/oidc/test/route.js accepts an issuerUrl value from the request body and forwards it directly to fetchOidcDiscovery(). That function performs an HTTP request to the supplied URL and returns portions of the response to the caller.

Because the request is issued from the server, attackers can target hosts that are reachable only from the 9Router instance. This includes loopback interfaces, private RFC1918 subnets, cloud metadata endpoints, and internal service meshes. The response reflection permits fingerprinting of discovered services when they return JSON containing OIDC-shaped fields such as token_endpoint, authorization_endpoint, and jwks_uri.

When dashboard authentication is disabled, no credentials are required to invoke the endpoint. Attackers can enumerate internal infrastructure and derive information about identity providers that would otherwise be isolated from the internet.

Root Cause

The root cause is missing input validation and missing authentication on a sensitive server-side fetch operation. The fetchOidcDiscovery() function does not restrict the destination scheme, host, or IP range. It permits requests to loopback addresses (127.0.0.0/8, ::1), link-local ranges, and private networks. Combined with the endpoint's optional authentication, this creates an unauthenticated SSRF primitive.

Attack Vector

An attacker sends a crafted POST request to /api/auth/oidc/test with an issuerUrl pointing at an internal target. The 9Router backend performs an outbound HTTP fetch and returns response fields to the attacker. By iterating through addresses and ports, the attacker maps internal services. When target services return OIDC-shaped metadata, the attacker recovers token_endpoint and jwks_uri values usable for further reconnaissance against internal identity infrastructure.

No verified proof-of-concept code is published for CVE-2026-56677. See the GitHub Security Advisory GHSA-8g4w-4ffg-8vgx for the vendor's technical description.

Detection Methods for CVE-2026-56677

Indicators of Compromise

Repeated POST requests to /api/auth/oidc/test from a single source with varying issuerUrl values
Outbound HTTP requests from the 9Router host to loopback, link-local, or RFC1918 destinations
Application logs showing fetchOidcDiscovery() calls targeting non-public hostnames
Requests to cloud instance metadata endpoints such as 169.254.169.254 originating from the 9Router process

Detection Strategies

Inspect web server access logs for unauthenticated POST traffic to the OIDC test route
Correlate application-layer requests with egress network flows to identify internal fetch attempts
Alert on 9Router-initiated connections that terminate on private IP ranges or non-standard ports
Baseline the set of legitimate OIDC issuer domains and flag deviations

Monitoring Recommendations

Ingest 9Router application logs and reverse proxy logs into a centralized analytics platform
Monitor DNS resolutions initiated by the 9Router service for internal-only hostnames
Track outbound connection counts per source process to detect scanning behavior
Retain OIDC discovery response payloads for forensic review during incident response

How to Mitigate CVE-2026-56677

Immediate Actions Required

Restrict network access to the /api/auth/oidc/test endpoint using a reverse proxy or firewall rule
Re-enable dashboard authentication so the endpoint requires a valid session
Deploy egress filtering that blocks the 9Router host from reaching loopback, link-local, and RFC1918 destinations except where required
Audit application logs for prior exploitation attempts targeting internal addresses

Patch Information

No fixed version is enumerated in the NVD entry at the time of publication. Consult the GitHub Security Advisory GHSA-8g4w-4ffg-8vgx for upstream remediation status and upgrade guidance.

Workarounds

Place 9Router behind an authenticated reverse proxy that rejects unauthenticated requests to administrative routes
Deny egress from the 9Router service to internal subnets and cloud metadata endpoints at the network layer
Validate issuerUrl values against an allowlist of trusted identity provider hostnames if custom patching is required
Disable the OIDC test endpoint in deployments that do not require dynamic issuer configuration

bash

# Example egress restriction using iptables to block SSRF to internal ranges
iptables -A OUTPUT -m owner --uid-owner 9router -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 169.254.0.0/16 -j REJECT