CVE-2026-56677 decolua CVE debrief

Who should care

Defenders responsible for 9Router instances, especially those with dashboard login disabled, should assess exposure and verify internal service vulnerability to potential scanning.

Why it matters

CVE-2026-56677 allows unauthenticated attackers to scan internal services and reflect OIDC discovery fields in 9Router versions 0.5.4 and earlier when dashboard login is disabled. Defenders should verify exposure and assess internal service vulnerability.

• Unauthenticated attackers can scan internal services
• OIDC discovery fields can be reflected
• Internal service vulnerability requires verification
• Dashboard login disabled increases risk

Technical summary

The 9Router AI router & token saver, in versions 0.5.4 and earlier, has a vulnerability in the POST /api/auth/oidc/test endpoint. This endpoint passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() without restricting private or loopback destinations. This allows unauthenticated attackers, when dashboard login is disabled, to scan internal services and reflect OIDC discovery fields, including token_endpoint and jwks_uri.

Defensive priority

Defenders should prioritize verifying exposure of 9Router instances, especially those with dashboard login disabled, and assess internal service vulnerability to potential scanning.

Recommended defensive actions

• Verify 9Router instance exposure, especially with dashboard login disabled
• Assess internal service vulnerability to potential scanning
• Review and update 9Router to the latest version if possible
• Confirm whether affected 9Router deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed 9Router systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed 9Router assets that need extra review
• Track exceptions, retest remediated 9Router assets, and close the item only after evidence is documented

Evidence notes

Evidence from the CVE Program and NVD indicates that 9Router versions 0.5.4 and earlier are vulnerable. The vulnerability allows unauthenticated attackers to scan internal services and reflect OIDC discovery fields.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.