Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-49352 critical CVSS 9.8

Vulnerability in 9router (CVE-2026-49352)

Summary

Vulnerability in 9router (CVE-2026-49352). Successful exploitation can lead to full system takeover. Exploitable via JWT_SECRET. Mitigation: upgrade to 0.4.45 or later.

Original description

The description as published by the source.

Summary

9router uses a publicly known hardcoded string "9router-default-secret-change-me" as the fallback of JWT secret for all Dashboard session JWTs when the JWT_SECRET environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, any unauthenticated remote attacker can forge a valid auth_token cookie and gain full access to dashboard and api (If JWT_SECRET is not set on server) . This vulnerable affected so many public 9router server

Details

Versions File Note
>= 0.2.21, <= 0.4.30 src/app/api/auth/login/route.js + src/middleware.js Introduced in commit 23cfb19
>= 0.4.31, <= 0.4.41 src/lib/auth/dashboardSession.js Relocated by OIDC refactor c3d91b0, secret unchanged

Vulnerable Code

v0.2.21 – v0.4.30 — src/app/api/auth/login/route.js and src/middleware.js:

const SECRET = new TextEncoder().encode(
  process.env.JWT_SECRET || "9router-default-secret-change-me"
);

v0.4.31 – v0.4.41 (current) — src/lib/auth/dashboardSession.js (centralized via OIDC refactor, commit c3d91b0):

const SECRET = new TextEncoder().encode(
  process.env.JWT_SECRET || "9router-default-secret-change-me"
);

The fallback string was introduced in commit 23cfb19 (2026-01-09) and has never been removed. The OIDC refactor in c3d91b0 only relocated it to a shared module . This vulnerability has existed since 9router first introduced authent…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-49352 has been found in 9router.
Attackers can target a specific entry point like JWT_SECRET over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 9.8/10.
What to do: upgrade 9router to 0.4.45 or later.
If unsure, ask your IT team or search "9router CVE-2026-49352" on the vendor's site.

CVE-2026-49352 (9router) — CWE-798 / CVSS v3 9.8
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: JWT_SECRET / auth_token / c3d91b0
Patched: 0.4.45 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-798) exists in 9router. Attackers reach the vulnerable code path via JWT_SECRET without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of 9router. Attack surface: JWT_SECRET / auth_token / c3d91b0.

🔥 Severity

Severity: Critical (CVSS 9.8/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to 0.4.45.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r '9router' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r '9router' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で 9router を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade 9router to 0.4.45

    ステージング環境で 0.4.45 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm 9router
[{"type":"SEMVER","events":[{"introduced":"0.2.21"},{"fixed":"0.4.45"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details