CVE-2026-62327 decolua CVE debrief

Who should care

Users of 9Router through version 0.4.41, AI provider account holders and administrators, and security teams should be aware of this vulnerability and take immediate action to secure their installations and monitor for potential unauthorized activity.

Technical summary

The vulnerability is caused by a missing authentication middleware on the Next.js API route /api/usage/stats. This allows unauthenticated attackers to access sensitive information, including plaintext API keys for all connected AI provider accounts. The API keys are exposed alongside token counts, cost breakdowns, and request metadata. The vulnerability affects 9Router through version 0.4.41 and enables unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.

Defensive priority

High

Recommended defensive actions

• Immediately update 9Router to a version that includes authentication middleware for the /api/usage/stats endpoint
• Rotate all API keys for connected AI provider accounts
• Monitor AI provider account activity for unauthorized usage
• Implement additional security measures, such as IP restrictions or rate limiting, for the /api/usage/stats endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-13T22:16:52.403Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability beyond the initial CVE record and NVD entry. Defenders should verify the accuracy of the information and be cautious of potential changes in the vulnerability details.

Official resources