CVE-2026-56682: 9Router Authentication Bypass Vulnerability

CVE-2026-56682 Overview

CVE-2026-56682 is a rate limiting bypass vulnerability affecting 9Router, an AI router and token saver, in versions prior to 0.5.6. The flaw lives in the login rate limiter, which trusts the client-supplied X-9r-Real-Ip header as the bucket key for tracking failed authentication attempts. Deployments that route requests directly to Next.js without the sanitizing custom-server.js wrapper are exposed. A remote unauthenticated attacker can rotate the header value on every request to bypass the five-attempt progressive lockout, enabling unthrottled password guessing against the dashboard login. The issue is fixed in version 0.5.6.

Critical Impact

Attackers can conduct unlimited password guessing attacks against the 9Router dashboard, potentially recovering administrative credentials and gaining full session access.

Affected Products

• 9Router versions prior to 0.5.6
• Deployments exposing Next.js directly without the custom-server.js wrapper
• 9Router dashboard login endpoint POST /api/auth/login

Discovery Timeline

• 2026-09-22 - CVE-2026-56682 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-56682

Vulnerability Analysis

The vulnerability is an improper restriction of excessive authentication attempts [CWE-307]. The login rate limiter in src/lib/auth/loginLimiter.js derives its bucket key from the X-9r-Real-Ip header supplied by the client. The functions getClientIp, checkLock, and recordFail all rely on this attacker-controlled value to track failed attempts against POST /api/auth/login.

Because the header is untrusted input, an attacker can supply a unique value on every request. Each guess is recorded under a fresh bucket, and the five-attempt progressive lockout that would return HTTP 429 never triggers. This transforms a hardened login flow into an open brute-force target. Successful password recovery yields an authenticated administrative session on the dashboard.

Root Cause

The root cause is misplaced trust in a client-controlled request header for security-relevant identity resolution. The design assumed requests would always be sanitized by custom-server.js, which strips X-9r-Real-Ip, X-Forwarded-For, and X-9r-Via-Proxy before Next.js handlers run. When operators expose Next.js directly, that sanitization never occurs and the limiter keys off spoofable data.

Attack Vector

The attack is remote, unauthenticated, and network-based. The attacker sends repeated POST /api/auth/login requests, incrementing or randomizing the X-9r-Real-Ip header on each attempt. No user interaction is required and complexity is low.

// Patch in custom-server.js — trust forwarding headers only from a local reverse proxy
const rest = args.filter((a) => typeof a !== "function");
if (!handler) return origCreate(...args);
const wrapped = (req, res) => {
  const socketIp = req.socket && req.socket.remoteAddress ? req.socket.remoteAddress : "";
  const xff = req.headers["x-forwarded-for"];
  const xRealIp = req.headers["x-real-ip"];
  const viaProxy = !!(xff || xRealIp);
  const isLoopbackProxy = socketIp === "127.0.0.1" || socketIp === "::1" || socketIp === "::ffff:127.0.0.1";
  // Trust forwarding headers only when the TCP peer is a local reverse proxy.
  // Direct/public sockets remain keyed by the unspoofable peer address.
  const proxyIp = xRealIp || (xff ? String(xff).split(",")[0].trim() : "");
  const ip = isLoopbackProxy && proxyIp ? proxyIp : socketIp;
  delete req.headers["x-9r-real-ip"];
  delete req.headers["x-forwarded-for"];
  delete req.headers["x-9r-via-proxy"];

Source: GitHub Commit efd20be

Detection Methods for CVE-2026-56682

Indicators of Compromise

• High volume of POST /api/auth/login requests from a single TCP peer with rapidly varying X-9r-Real-Ip header values.
• Login failure counts on the dashboard that never trigger HTTP 429 lockout responses despite exceeding five attempts.
• Successful authentication events preceded by dozens or hundreds of failed attempts within a short window.

Detection Strategies

• Correlate authentication failures by source socket address rather than by forwarded header values.
• Alert on any request path /api/auth/login where the X-9r-Real-Ip value differs across sequential requests from the same TCP peer.
• Monitor authentication logs for absence of expected 429 responses when failure thresholds are crossed.

Monitoring Recommendations

• Enable verbose access logging on the reverse proxy fronting 9Router to capture both the socket peer and forwarded headers.
• Track baseline login attempt rates per source IP and alert on statistical anomalies.
• Review dashboard admin session creation events and validate against expected operator activity.

How to Mitigate CVE-2026-56682

Immediate Actions Required

• Upgrade 9Router to version 0.5.6 or later immediately.
• Ensure all inbound requests are routed through the custom-server.js wrapper rather than directly to Next.js.
• Rotate any administrative dashboard credentials that may have been exposed to brute-force attempts.
• Review authentication logs for the affected time window to identify successful logins that followed abnormal failure volumes.

Patch Information

The fix is delivered in 9Router release v0.5.6. The GitHub Security Advisory GHSA-32gc-64m7-hj7v documents the flaw. The remediation commit trusts forwarding headers only when the TCP peer is a loopback reverse proxy, and otherwise keys the rate limiter on the unspoofable socket address.

Workarounds

• Front 9Router with a hardened reverse proxy that strips or overwrites X-9r-Real-Ip, X-Forwarded-For, and X-9r-Via-Proxy before forwarding.
• Enforce network-level rate limiting on POST /api/auth/login at the proxy or WAF layer, keyed on the true client IP.
• Restrict dashboard access to trusted management networks or via VPN until the upgrade is applied.

# Example nginx configuration to strip spoofable headers and rate limit login
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

server {
    location /api/auth/login {
        limit_req zone=login burst=5 nodelay;
        proxy_set_header X-9r-Real-Ip "";
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-9r-Via-Proxy "";
        proxy_pass http://9router_upstream;
    }
}