Authentication Bypass in 9Router AI Router by Decolua
CVE-2026-46339

10CRITICAL

Key Information:

Vendor

Decolua

Status
9router
Vendor
CVE Published:
15 July 2026

What is CVE-2026-46339?

The 9Router product, developed by Decolua, suffered from an authentication bypass vulnerability in its middleware. Versions 0.4.30 to 0.4.36 included a flaw in the src/proxy.js middleware that left critical API endpoints, such as /api/cli-tools/* and /api/mcp/*, unprotected. This meant that attackers could register custom plugins unauthorizedly via the src/app/api/cli-tools/cowork-settings/route.js file and execute commands through the MCP bridge. Fortunately, this issue has been addressed in version 0.4.37.

Affected Version(s)

9router >= 0.4.30, < 0.4.37

References

https://github.com/decolua/9router/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/decolua/9router/commit/992f4db4a0d858b...
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.