CVE-2026-623279Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
Updated under an hour ago ()
Does this affect you?
It affects decolua 9Router. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-306, CWE-522
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Jul 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
decolua 9Router decolua:9router (from the name) | through 0.4.41 | CNA record |
References
- https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86vendor-advisory
- https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-statsthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.