https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:59:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338216 EUVD-2026-338216 https://cve.radiocsirt.org/vuln/euvd-2026-338216 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56679 <p>9Router is an AI router &amp; token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.</p> <p>9Router is an AI router &amp; token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56679 https://cve.radiocsirt.org/vuln/ghsa-vmjq-hvgq-2wv4 <p><strong>Affected:</strong> npm: 9router</p> <p>### Summary The `PATCH /api/settings` endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably `requireLogin`. Setting `requireLogin: false` disables authentication for the whole application, exposing all protected routes (e.g. `/api/keys`, `/api/providers`) to unauthenticated access.</p> <p>### Details Root cause is unfiltered mass assignment (CWE-915):</p> <p>- `src/app/api/settings/route.js` (PATCH handler) parses the body and passes it to `updateSettings(body)`, with special handling only for `newPassword` and `oidcClientSecret`. All other fields pass through. - `src/lib/db/repos/settingsRepo.js` — `updateSettings` does `next = { ...current, ...updates }`, so any key in the body overwrites stored settings, including `requireLogin`, `tunnelDashboardAccess`, `authMode`. - `src/dashboardGuard.js` — `isAuthenticated` returns `true` whenever `settings.requireLogin === false`, bypassing auth on all protected routes.</p> <p>This is distinct from CVE-2026-5842 (CWE-285, pre-auth bypass on `/api`, patched in 0.3.75). This finding requires a valid authenticated session and abuses input handling, not missing authentication.</p> <p>### PoC Instance on `localhost:20128`, default password `123456`.</p> <p>1. Authenticate, capture session: `POST /api/auth/login` body `{&#34;password&#34;:&#34;123456&#34;}` → `200 {&#34;success&#34;:true}` 2. Mass-assign with the authenticated session: `PATCH /api…</p> <p><strong>Affected:</strong> npm: 9router</p> <p>### Summary The `PATCH /api/settings` endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably `requireLogin`. Setting `requireLogin: false` disables authentication for the whole application, exposing all protected routes (e.g. `/api/keys`, `/api/providers`) to unauthenticated access.</p> <p>### Details Root cause is unfiltered mass assignment (CWE-915):</p> <p>- `src/app/api/settings/route.js` (PATCH handler) parses the body and passes it to `updateSettings(body)`, with special handling only for `newPassword` and `oidcClientSecret`. All other fields pass through. - `src/lib/db/repos/settingsRepo.js` — `updateSettings` does `next = { ...current, ...updates }`, so any key in the body overwrites stored settings, including `requireLogin`, `tunnelDashboardAccess`, `authMode`. - `src/dashboardGuard.js` — `isAuthenticated` returns `true` whenever `settings.requireLogin === false`, bypassing auth on all protected routes.</p> <p>This is distinct from CVE-2026-5842 (CWE-285, pre-auth bypass on `/api`, patched in 0.3.75). This finding requires a valid authenticated session and abuses input handling, not missing authentication.</p> <p>### PoC Instance on `localhost:20128`, default password `123456`.</p> <p>1. Authenticate, capture session: `POST /api/auth/login` body `{&#34;password&#34;:&#34;123456&#34;}` → `200 {&#34;success&#34;:true}` 2. Mass-assign with the authenticated session: `PATCH /api…</p> https://cve.radiocsirt.org/vuln/ghsa-vmjq-hvgq-2wv4