The flaw resides in the Next.js API route for /api/usage/stats, where missing authentication middleware allows any remote party to retrieve plain‑text API keys for all connected AI provider accounts. The disclosed keys, along with cost and request metadata, enable an attacker to use the accounts without permission, potentially incurring billing fraud and exhausting quotas. This is a classic information‑disclosure problem (CWE‑306, CWE‑522).

The vulnerability affects decolua's 9Router product, specifically version 0.4.41 and all prior releases that have not applied the fix.

The CVSS score of 9.3 indicates a high‑severity risk. Without authentication protection, an attacker can send a single unauthenticated HTTP request to the vulnerable endpoint, requiring no privileges or special conditions. The EPSS score of < 1% suggests a low probability of exploitation, yet the absence of authentication middleware makes the attack path trivial. The CVE is not listed in the CISA KEV catalog, but the potential for billing fraud and data exposure warrants immediate attention.