The vulnerability lies in the authentication rate limiting logic, which uses the X-Forwarded-For header—an attacker-controlled value—to identify clients. Because this header can be spoofed for each login attempt, the login limiter unintentionally assigns a new bucket for every request. The result is that a remote attacker can bypass the 5-attempt threshold, avoid progressive lockout, and perform unlimited brute‑force attempts on the dashboard. The weakness corresponds to CWE‑307, an authentication bypass via spoofable request data. If exploited, an attacker can gain unauthorized access to the administrative interface, compromising confidentiality and potentially enabling further privilege escalation.

The affected product is the 9Router AI router and token saver developed by decolua, specifically versions prior to 0.4.80. The login rate limiter bug exists in src/lib/auth/loginLimiter.js and src/app/api/auth/login/route.js, and it is fixed in release v0.4.80. Administrators running earlier releases are therefore impacted.

The CVSS score is 7.3, indicating a high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the flaw is not listed in CISA KEV, so the likelihood of widespread exploitation is low. However, the attack vector is remote over HTTP(S), and no credential or privilege escalation prerequisites are required: an attacker can inject a spoofed X-Forwarded-For header in standard login requests. The bypass allows unlimited login attempts, making this a critical operational risk for exposed dashboards.