GHSA-86m2-fcxq-5q7c: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

9router has a critical authentication bypass where attackers can spoof the `Host` header (a message field that tells the server which domain is being accessed) to trick the application into treating their requests as local, granting them unauthenticated access to the `/v1` AI proxy endpoint. This allows attackers to make requests to AI services using the victim's paid API keys, stealing costs and data, or to perform SSRF (server-side request forgery, where the attacker makes the server fetch URLs of their choosing) attacks against internal systems.