9Router is an AI router & token saver. From version 0.2.21 through version 0.4.43 inclusive, the application used a hardcoded fallback JWT secret, 9router-default-secret-change-me, embedded in various source files such as src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js. When the environment variable JWT_SECRET is unset, the system falls back to this secret, allowing attackers to forge an auth_token cookie. A forged token signed with the known secret permits an attacker to impersonate any user, bypassing authentication and gaining unauthorized access to privileged functionality and data. The flaw, a classic instance of CWE‑798, was remedied in release 0.4.44, which removed the hardcoded fallback secret.

The issue affects decolua's 9Router releases from version 0.2.21 through 0.4.43 inclusive. Version 0.4.44 introduces a fix that removes the hardcoded fallback secret. All deployments of the affected versions on any operating environment are vulnerable when the JWT_SECRET is not explicitly set.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS indicates that exploit Likelihood is currently very low (<1%), and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is network‑based: an attacker who can set or modify the HTTP cookie for the 9Router domain can inject the forged token and bypass authentication. The vulnerability does not require privileged code execution or kernel‑level access; it only requires the ability to serve crafted requests to an exposed 9Router instance.