https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:45:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-355057 EUVD-2026-355057 https://cve.radiocsirt.org/vuln/euvd-2026-355057 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56677 <p>9Router is an AI router &amp; token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.</p> <p>9Router is an AI router &amp; token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56677 https://cve.radiocsirt.org/vuln/ghsa-8g4w-4ffg-8vgx <p><strong>Affected:</strong> npm: 9router</p> <p>### Summary</p> <p>A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the `/api/auth/oidc/test` endpoint. The application accepts a user-controlled URL string through the `issuerUrl` parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.</p> <p>Notably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.</p> <p>Depending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:</p> <p>1. **Port Scanning / Blind SSRF (Non-OIDC structures):** Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like &#34;Unexpected token...&#34;), allowing internal network reconnaissance. 2. **Full Data Feed Manipulation (OIDC matching structures):** If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.</p> <p>---</p> <p>### Vulnerable Code Details</p> <p>- **Classification:** VE-Class 4 — OIDC SSRF via issuerUrl (Unauthenticated) - **File Path:** `src/app/api/auth/oidc/test/route.js` - **Vulnerab…</p> <p><strong>Affected:</strong> npm: 9router</p> <p>### Summary</p> <p>A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the `/api/auth/oidc/test` endpoint. The application accepts a user-controlled URL string through the `issuerUrl` parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.</p> <p>Notably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.</p> <p>Depending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:</p> <p>1. **Port Scanning / Blind SSRF (Non-OIDC structures):** Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like &#34;Unexpected token...&#34;), allowing internal network reconnaissance. 2. **Full Data Feed Manipulation (OIDC matching structures):** If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.</p> <p>---</p> <p>### Vulnerable Code Details</p> <p>- **Classification:** VE-Class 4 — OIDC SSRF via issuerUrl (Unauthenticated) - **File Path:** `src/app/api/auth/oidc/test/route.js` - **Vulnerab…</p> https://cve.radiocsirt.org/vuln/ghsa-8g4w-4ffg-8vgx