CVE-2026-56679
NONE—CVSS v3
—CVSS v2
0.32%
EPSS (exploit probability)
CWE-915CWE
Description
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.
Affected routers (0)
No routers currently mapped to this CVE in our database.