Security Advisory

CVE-2026-55638

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-10 15:38:21

Last updated 2026-07-10 16:46:33

Assigner GitHub_M

CVSS score 8.6

State PUBLISHED

Description

9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2.

← Browse all CVEs View on cve.org ↗