CVE-2026-55501

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.

• CWE-307

• https://github.com/decolua/9router/commit/7648c3412b403a29f04967c4b4e9725e228791d4
• https://github.com/decolua/9router/releases/tag/v0.4.80
• https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7
• https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55495Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-55496Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-55497Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-55499Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-5550A vulnerability was identified in Tenda AC10 16.03.10.10_mul…8.8
• CVE-2026-555009Router is an AI router & token saver. Prior to 0.4.80, the …9.9
• CVE-2026-55502Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-55509WsgiDAV is a generic and extendable WebDAV server based on W…8.8
• CVE-2026-5551A security flaw has been discovered in itsourcecode Free Hot…7.3
• CVE-2026-55510ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55511Yamcs is a mission control framework. Prior to 5.12.8 and 5.…9.1
• CVE-2026-55512nebula-mesh is a self-hosted control plane for Slack Nebula …5.3