---
id: CVE-2026-56677
title: 9Router is an AI router & token saver
summary: >-
  9Router is an AI router & token saver. In 0.5.4 and earlier, the POST
  /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the
  user-controlled issuerUrl parameter to fetchOidcDiscovery() in
  src/lib/auth/oidc.js with…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-306
  - CWE-918
vendor: 9router
product: 9router
affected:
  - 9router <= 0.5.4
published: '2026-08-17'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:44.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56677'
references:
  - url: 'https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx'
    label: security-advisories@github.com
  - url: 'https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-8g4w-4ffg-8vgx'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00375
epssPercentile: 0.28619
aliases:
  - GHSA-8g4w-4ffg-8vgx
ecosystem: npm
ingestedAt: '2026-08-17T22:01:16.707Z'
---

## Overview

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-56677)

Affected packages:

- `9router <= 0.5.4`

Source: https://github.com/advisories/GHSA-8g4w-4ffg-8vgx