GHSA-5mj8-gf6m-fhw8: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
Summary
9Router has an authentication bypass vulnerability where attackers can fake being a local client by adding a spoofed X-9r-Real-Ip header (a custom HTTP header that tells the server where a request came from). The app trusts this header to decide whether to require an API key, but when deployed without its protective wrapper layer, attackers can send X-9r-Real-Ip: 127.0.0.1 to bypass authentication and gain unauthorized access to the LLM API and the owner's provider resources.
Solution / Mitigation
The source recommends four mitigations: (1) Do not trust X-9r-Real-Ip or any X-9r-* header when received directly from clients. (2) Derive the client address for authorization from a trusted transport-level source, such as req.socket.remoteAddress, rather than a request header. (3) If custom-server.js is required for the security model, fail closed when its trusted marker is absent, and explicitly strip/reject any inbound client-supplied X-9r-* headers at the edge. (4) Document supported, secure startup modes so the application is not run in a configuration where the header is attacker-controllable.
Vulnerability Details
EPSS: 0.0%
Yes
September 22, 2026
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-5mj8-gf6m-fhw8
First tracked: September 22, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 92%