The vulnerability exists in 9Router's login flow where the application uses the client‑supplied X‑9r‑Real‑Ip header as the key for tracking login attempts. Because the header can be spoofed, an attacker can rotate it with each guess, causing the login limiter to treat each attempt as a new bucket. This bypass prevents the five‑attempt progressive lockout and allows the attacker to perform password guessing against the dashboard without any throttling or rate limits. Successful guessing can lead to an administrative session on the router.

Affected deployments include any versions of decolua 9Router released before version 0.5.6. The vulnerability is present only when requests are able to reach Next.js without the custom‑server.js wrapper that sanitizes the X‑9r‑Real‑Ip header. There are no known mitigations for earlier versions apart from applying the patch.

The CVSS score for this issue is 5.3, indicating a moderate severity. The lack of an EPSS score and the fact that it is not listed in the CISA KEV catalog suggest that large‑scale exploitation has not yet been observed, yet the attack vector is simple: a remote unauthenticated attacker can send HTTP requests to /api/auth/login from any IP. Because the bypass relies on the application accepting an arbitrary header, an attacker can run the brute‑force attack entirely from outside the network, making it a realistic threat for exposed deployments.