CVE-2026-62327

9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

Published Jul 13, 2026 CVSS 4.0 · 9.3 Critical EPSS 6.3% KEV · Not listed

Description

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.

Analysis

Technical impact

The flaw resides in the Next.js API route for /api/usage/stats, where missing authentication middleware allows any remote party to retrieve plain‑text API keys for all connected AI provider accounts. The disclosed keys, along with cost and request metadata, enable an attacker to use the accounts without permission, potentially incurring billing fraud and exhausting quotas. This is a classic information‑disclosure problem (CWE‑306, CWE‑522).

Affected Systems

The vulnerability affects decolua's 9Router product, specifically version 0.4.41 and all prior releases that have not applied the fix.

Risk and Exploitability

The CVSS score of 9.3 indicates a high‑severity risk. Without authentication protection, an attacker can send a single unauthenticated HTTP request to the vulnerable endpoint, requiring no privileges or special conditions. The EPSS score of 6% suggests a moderate probability of exploitation. The absence of authentication middleware makes the attack path trivial. The CVE is not listed in the CISA KEV catalog, but the potential for billing fraud and data exposure warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

decolua

9Router

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.4.41

No data.

Vendor Product Versions

Decolua

9router

Version	Status	Scheme	Platform
`[0,0.4.41]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any vendor‑issued update for 9Router when it becomes available, as it will add authentication to the /api/usage/stats endpoint.
If an update is not immediately available, block or restrict unauthenticated access to /api/usage/stats at the network or reverse‑proxy level to prevent exposure of the keys.
Rotate all API keys used by 9Router with the connected AI providers to invalidate any keys that may have been exposed before the fix is deployed.

Generated by OpenCVE AI on October 25, 2026 at 19:16 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 6.3% (6.272% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86
https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats

History

Jul 14, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 14, 2026 12:45 PM Description updated View changes

Type	Values Removed	Values Added
Description	9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.	9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.

Jul 13, 2026 11:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Decolua Decolua 9router
Vendors & Products		Decolua Decolua 9router

Jul 13, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.
Title		9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
Weaknesses		CWE-306 CWE-522
References		https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86 https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`