9Router up to version 0.4.41 does not apply authentication checks to the Next.js API routes located under src/app/api/providers. As a result any network user can invoke these endpoints without providing credentials. The flaw permits enumeration, creation, modification, or deletion of provider connections, which may expose partial credentials, OAuth tokens, and API keys, allow attackers to redirect AI traffic to attacker‑controlled servers, or cause a denial of service by wiping all provider connections. The weakness is categorized as CWE‑306, a missing authentication flaw.

The issue affects all releases of decolua’s 9Router up to and including version 0.4.41. No later versions are known to be impacted.

The CVSS base score of 9.3 indicates critical severity, while the EPSS score of 2% suggests a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalogue. Because no authentication is required, any remote attacker with network access to the API can exploit the flaw directly, making it highly readily exploitable. Successful exploitation would compromise provider credentials, enable malicious traffic redirection, and can bring the service to a halt, affecting confidentiality, integrity, and availability.