GHSA-5mj8-gf6m-fhw8: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

Summary

9router decides whether a request is local by trusting the client-supplied X-9r-Real-Ip header in isLocalRequest() within src/dashboardGuard.js. When the app runs without custom-server.js, which normally strips and regenerates that header, an unauthenticated remote attacker can send X-9r-Real-Ip: 127.0.0.1 to reach /api/v1/* without an API key. The reported impact includes unauthorized use of the owner's configured LLM provider connections and consumption of paid API credits. The issue was verified on 9router-app 0.5.4 (Next.js 16.2.9) using GET /api/v1/models.

Mitigation

Do not trust X-9r-Real-Ip (or any X-9r-* header) received directly from clients. Derive the client address for authorization from a trusted transport-level source, such as req.socket.remoteAddress. If custom-server.js is required for the security model, fail closed when its trusted marker is absent and strip or reject inbound client-supplied X-9r-* headers at the edge. Document supported secure startup modes so the header cannot be attacker-controlled.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News