https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 12:36:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335674 EUVD-2026-335674 https://cve.radiocsirt.org/vuln/euvd-2026-335674 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55500 <p>9Router is an AI router &amp; token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.</p> <p>9Router is an AI router &amp; token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55500 https://cve.radiocsirt.org/vuln/ghsa-qvfm-67h2-2qfx <p><strong>Affected:</strong> npm: 9router</p> <p>## Summary</p> <p>The `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the `ALWAYS_PROTECTED` middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover.</p> <p>## Description</p> <p>The endpoint `/api/settings/database` is listed in `ALWAYS_PROTECTED` in `dashboardGuard.js` (line 42), which requires a valid JWT token or CLI token. However, this protection is insufficient because:</p> <p>1. **GET (Export):** Returns the complete database including API keys (`key` field in `apiKeys` table), OAuth tokens, and all provider credentials. Line 80 in `src/lib/db/index.js`: `apiKeys: db.all(&#34;SELECT * FROM apiKeys&#34;).map(...)` — the `key` field contains the plaintext API key value.</p> <p>2. **POST (Import):** Accepts arbitrary JSON and performs a complete database wipe-and-replace in a transaction (lines 102-163 in `src/lib/db/index.js`). This replaces all settings including the password hash, effectively allowing an attacker to set their own password.</p> <p>3. The exported data includes `apiKeys` with their plaintext `key` values, `providerConnections` with all OAuth tokens, and `settings` with OIDC client secrets.</p> <p>### Evidence</p> <p>**File:** `src/app/api/settings/database/route.js` ```javascript export async function GET() { const pa…</p> <p><strong>Affected:</strong> npm: 9router</p> <p>## Summary</p> <p>The `/api/settings/database` endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the `ALWAYS_PROTECTED` middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover.</p> <p>## Description</p> <p>The endpoint `/api/settings/database` is listed in `ALWAYS_PROTECTED` in `dashboardGuard.js` (line 42), which requires a valid JWT token or CLI token. However, this protection is insufficient because:</p> <p>1. **GET (Export):** Returns the complete database including API keys (`key` field in `apiKeys` table), OAuth tokens, and all provider credentials. Line 80 in `src/lib/db/index.js`: `apiKeys: db.all(&#34;SELECT * FROM apiKeys&#34;).map(...)` — the `key` field contains the plaintext API key value.</p> <p>2. **POST (Import):** Accepts arbitrary JSON and performs a complete database wipe-and-replace in a transaction (lines 102-163 in `src/lib/db/index.js`). This replaces all settings including the password hash, effectively allowing an attacker to set their own password.</p> <p>3. The exported data includes `apiKeys` with their plaintext `key` values, `providerConnections` with all OAuth tokens, and `settings` with OIDC client secrets.</p> <p>### Evidence</p> <p>**File:** `src/app/api/settings/database/route.js` ```javascript export async function GET() { const pa…</p> https://cve.radiocsirt.org/vuln/ghsa-qvfm-67h2-2qfx