CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86
https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats
https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) 9Router hasta la versión 0.4.41 contiene una vulnerabilidad de revelación de información no autenticada que permite a atacantes remotos recuperar claves API en texto plano para todas las cuentas de proveedores de IA conectadas enviando una única solicitud no autenticada al endpoint /api/usage/stats. Los atacantes pueden explotar el middleware de autenticación faltante en la ruta API de Next.js para obtener cadenas completas de claves API junto con los recuentos de tokens, desgloses de costos y metadatos de solicitud, lo que permite el uso no autorizado de cuentas de proveedores de IA conectadas, fraude de facturación y agotamiento de cuotas.

Information

Published : 2026-07-13 22:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-62327

Mitre link : CVE-2026-62327

CVE.ORG link : CVE-2026-62327

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-62327", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62327", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T14:26:02.734466Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/decolua/9router", "vendor": "decolua", "product": "9Router", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.4.41"}], "packageURL": "pkg:npm/9router", "defaultStatus": "unaffected"}]}], "published": "2026-07-13T22:16:52.403", "references": [{"url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion."}, {"lang": "es", "value": "9Router hasta la versi\u00f3n 0.4.41 contiene una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n no autenticada que permite a atacantes remotos recuperar claves API en texto plano para todas las cuentas de proveedores de IA conectadas enviando una \u00fanica solicitud no autenticada al endpoint /api/usage/stats. Los atacantes pueden explotar el middleware de autenticaci\u00f3n faltante en la ruta API de Next.js para obtener cadenas completas de claves API junto con los recuentos de tokens, desgloses de costos y metadatos de solicitud, lo que permite el uso no autorizado de cuentas de proveedores de IA conectadas, fraude de facturaci\u00f3n y agotamiento de cuotas."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "disclosure@vulncheck.com"}