CVE-2026-49352 - 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Back Back to CVE browser

CRITICAL

9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Published Jul 15, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.60%

Description

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

Affected products

Vendor Decolua Product 9router Default
n/a
- Version
  >= 0.2.21, < 0.4.44
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Decolua

9router

n/a

Version	Status	Constraints
>= 0.2.21, < 0.4.44	affected	-

Ecosystem	Package	Introduced	Fixed
npm	9router	0.2.21	0.4.45

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44809
Advisory
https://github.com/advisories/GHSA-jphh-m39h-6gwx
Advisory
https://github.com/decolua/9router/commit/fe3ce25ae3cda48c0702c2d452e17f6ec214009d
x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.4.44
x_refsource_MISC
https://github.com/decolua/9router/security/advisories/GHSA-jphh-m39h-6gwx
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44809		Advisory
https://github.com/advisories/GHSA-jphh-m39h-6gwx		Advisory
https://github.com/decolua/9router/commit/fe3ce25ae3cda48c0702c2d452e17f6ec214009d		x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.4.44		x_refsource_MISC
https://github.com/decolua/9router/security/advisories/GHSA-jphh-m39h-6gwx		exploitx_refsource_CONFIRM