CVE-2026-56682

Description

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-307, CWE-807
Reserved: 2026-06-22
Published: 2026-09-22 16:09 UTC
Last updated: 2026-09-22 17:23 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/56xxx/CVE-2026-56682.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 17:17:24 UTC
NVD last modified: 2026-09-22 18:17:15 UTC
NVD CVSS v3.1: 5.3 / 10 MEDIUM source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability subscore: 3.9 / 10
Impact subscore: 1.4 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84542
Assigner: GitHub_M
Published: Sep 22, 2026, 4:09:07 PM
Updated: Sep 22, 2026, 5:23:12 PM
EUVD base score (CVSS 3.1): 5.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EUVD-reported EPSS: 0.0000
Vendors: decolua
Products: 9router (< 0.5.6)
Aliases: GHSA-32gc-64m7-hj7v

ENISA description: 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
decolua	9router	`< 0.5.6` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v x_refsource_CONFIRM
https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3 x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.5.6 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3 security-advisories@github.com
https://github.com/decolua/9router/releases/tag/v0.5.6 security-advisories@github.com
https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v security-advisories@github.com
https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v 134c704f-9b21-4f2e-91b3-4a467353bcc0

Remediations (10)

CISA orders urgent patches for three exploited Linux flaws

web:dataconomy.com

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch them or stop using affected products by Sept. 21. The flaws are CVE -2025-39682, CVE - 2026 -53266 and CVE -2025-39964, with severity scores of 9.8, 8.8 and 7.8, respectively. All three have available patches, and Red Hat said they are being actively exploited. Red ...

2026-09-23 15:45 UTC
Out-of-band Security Notification (September 2, 2026)

web:my.f5.com

On September 2, 2026 , F5 announced the following security issues. This document is intended to serve as an index of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles.

2026-09-23 15:45 UTC
CISA KEV Adds Three Linux Kernel Flaws Under Active Exploitation ...

web:news.shield53.com

As reported by SecurityAffairs, CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, triggering mandatory remediation for federal agencies and strong advisory action for private-sector organizations. The inclusion of CVE -2025-39682, CVE -2025-39964, and CVE - 2026 -53266 confirms that these flaws are no longer theoretical — they are being ...

2026-09-23 15:45 UTC
Cisco Advance Notification for Publication of September 16, 2026 ...

web:sec.cloudapps.cisco.com

On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...

2026-09-23 15:45 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-23 15:45 UTC
Linux users beware — CISA flags three major security issues you need to ...

web:tech.yahoo.com

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux flaws to its Known Exploited Vulnerabilities (KEV) catalog, signaling abuse in the wild and giving government agencies a deadline to patch or stop using the flawed product entirely.

2026-09-23 15:45 UTC
CISA Puts Three Linux Kernel Flaws on KEV, Federal Agencies Get Two ...

web:threat-intelligence.redeyesecurity.com

CISA added three actively exploited Linux kernel vulnerabilities to the KEV catalog on September 19, 2026 , with a federal patch deadline of September 21. Red Hat confirmed public exploit code exists for all three. The bugs hit the kTLS receive path, the ebtables SNAT ARP rewrite path, and AF_ALG crypto sockets.

2026-09-23 15:45 UTC
CVE-2026-56188: Install July Updates to Fix Windows Network RCE

web:windowsforum.com

Microsoft's July 14 security updates fix CVE - 2026 -56188, a critical remote code execution vulnerability in the Windows Server Network driver that can be triggered by an unauthenticated attacker over a network.

2026-09-23 15:45 UTC
CISA Adds Three Exploited Linux Kernel Flaws to KEV

web:www.0daynews.com

If you're on an unsupported kernel, the remediation path is an upgrade, not a patch . Patch order: CVE -2025-39682 first, CVSS 9.8, TLS receive path. CVE - 2026 -53266 second, especially on systems running ebtables for bridging or container networking where Red Hat-confirmed public exploits are already in the wild.

2026-09-23 15:45 UTC
CISA KEV September 16, 2026: Three CVE Patch Analysis

web:www.secpod.com

Patch Timeline & Exploitation Gap Analysis The September 16, 2026 dataset contains three CISA KEV vulnerabilities. Each record was added to the catalog on September 16, 2026 and assigned a remediation deadline of September 19, 2026 . Consequently, all three vulnerabilities have an identical three-calendar-day KEV inclusion-to- remediation window.

2026-09-23 15:45 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-56682.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56682",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T17:22:54.716257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T17:23:12.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429. This permits unthrottled password guessing against the dashboard login and can lead to an administrative session if the password is recovered. This issue is fixed in version 0.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:09:07.512Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decolua/9router/security/advisories/GHSA-32gc-64m7-hj7v"
        },
        {
          "name": "https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/commit/efd20be8d81ef2e256a7037f3aa78e6b567b5fd3"
        },
        {
          "name": "https://github.com/decolua/9router/releases/tag/v0.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/releases/tag/v0.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-32gc-64m7-hj7v",
        "discovery": "UNKNOWN"
      },
      "title": "9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56682",
    "datePublished": "2026-09-22T16:09:07.512Z",
    "dateReserved": "2026-06-22T16:39:01.044Z",
    "dateUpdated": "2026-09-22T17:23:12.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}