CVE-2026-62327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62327", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-13T21:36:08.380Z", "datePublished": "2026-07-13T21:37:51.416Z", "dateUpdated": "2026-07-14T14:30:46.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T12:08:55.335Z"}, "datePublic": "2026-06-13T00:00:00.000Z", "title": "9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats", "descriptions": [{"lang": "en", "value": "9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function", "type": "CWE"}, {"lang": "en", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials", "type": "CWE"}]}], "affected": [{"vendor": "decolua", "product": "9Router", "defaultStatus": "unaffected", "packageURL": "pkg:npm/9router", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "0.4.41"}], "repo": "https://github.com/decolua/9router"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "references": [{"url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86", "name": "GitHub Security Advisory (GHSA-vjc7-jrh9-9j86)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats"}], "credits": [{"lang": "en", "value": "Ng\u00f4 T\u1ea5n T\u00e0i (@newnol)", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}, "tags": ["x_open-source"]}, "adp": [{"references": [{"url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T14:26:02.734466Z", "id": "CVE-2026-62327", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T14:30:46.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"tags": ["x_open-source"], "title": "9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats", "credits": [{"lang": "en", "type": "reporter", "value": "Ng\u00f4 T\u1ea5n T\u00e0i (@newnol)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/decolua/9router", "vendor": "decolua", "product": "9Router", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.4.41"}], "packageURL": "pkg:npm/9router", "defaultStatus": "unaffected"}], "datePublic": "2026-06-13T00:00:00.000Z", "references": [{"url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86", "name": "GitHub Security Advisory (GHSA-vjc7-jrh9-9j86)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats", "name": "VulnCheck Advisory: 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}, {"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-13T21:37:51.416Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62327", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T14:26:02.734466Z"}}}], "references": [{"url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-14T14:26:16.591Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-62327", "state": "PUBLISHED", "dateUpdated": "2026-07-13T21:37:51.416Z", "dateReserved": "2026-07-13T21:36:08.380Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-13T21:37:51.416Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/9router", "product": "9Router", "repo": "https://github.com/decolua/9router", "vendor": "decolua", "versions": [{"lessThanOrEqual": "0.4.41", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion."}, {"lang": "es", "value": "9Router hasta la versi\u00f3n 0.4.41 contiene una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n no autenticada que permite a atacantes remotos recuperar claves API en texto plano para todas las cuentas de proveedores de IA conectadas enviando una \u00fanica solicitud no autenticada al endpoint /api/usage/stats. Los atacantes pueden explotar el middleware de autenticaci\u00f3n faltante en la ruta API de Next.js para obtener cadenas completas de claves API junto con los recuentos de tokens, desgloses de costos y metadatos de solicitud, lo que permite el uso no autorizado de cuentas de proveedores de IA conectadas, fraude de facturaci\u00f3n y agotamiento de cuotas."}], "id": "CVE-2026-62327", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62327", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T14:26:02.734466Z", "version": "2.0.3"}}]}, "published": "2026-07-13T22:16:52.403", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-522"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.4.41]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "9Router", "source": "cna", "vendor": "decolua"}, "product": "9router", "vendor": "decolua"}], "created": "2026-07-13T23:15:16.479820+00:00", "updated": "2026-10-25T19:30:14.985286+00:00", "vendors": ["decolua", "decolua$PRODUCT$9router"]}