The vulnerability exists in the 9Router AI router, where the POST /api/auth/oidc/test endpoint accepts a user‑controlled issuerUrl without filtering against private or loopback destinations. This flaw allows an attacker to cause the server to fetch OIDC discovery documents from arbitrary URLs, potentially revealing internal endpoints and returning sensitive fields such as token_endpoint and jwks_uri. The impact is an internal network reconnaissance and data leakage that could be leveraged for further attacks.

The affected product is 9Router by decolua. Versions 0.5.4 and earlier are vulnerable. Users should verify that they are running a later release to avoid exploitation.

The CVSS score of 8.6 classifies the flaw as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The core attack vector is the POST /api/auth/oidc/test endpoint; attackers do not need authentication when a dashboard login is disabled, so the risk window is broad. Successful exploitation would enable the attacker to query internal services and gather configuration details, which could be a stepping stone to further compromise.