CVE-2026-56678

6.4 Moyenne

Publiée le 15/07/2026 à 23:16 · Modifiée le 16/07/2026 à 16:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.

Traduire en français

Produits concernés

decolua 9router

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-20
CWE-918

Références

https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f
https://github.com/decolua/9router/releases/tag/v0.5.6
https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m
https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories