CVE-2026-49352

CRITICAL9.8

9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Published Jul 15, 2026

Modified 2 months ago

Details

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

References

WEB

https://github.com/decolua/9router/commit/fe3ce25ae3cda48c0702c2d452e17f6ec214009d

WEB

https://github.com/decolua/9router/releases/tag/v0.4.44

WEB

https://github.com/decolua/9router/security/advisories/GHSA-jphh-m39h-6gwx

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-49352

CVSS Analysis

CVSS v3.1

9.8