high · 8.6CVE-2026-55638Aug 28, 2026

CVE-2026-55638: 9router Unauthenticated LLM Proxy Access via /codex Rewrite Authorization Bypass

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A missing path in 9router's middleware allow-list lets anyone hit the LLM proxy without an API key, draining the operator's provider credits.

Package9router
Ecosystemnpm
Affected< 0.5.2
Fixed in0.5.2
CVE-2026-55638: 9router Unauthenticated LLM Proxy Access via /codex Rewrite Authorization Bypass

The problem

9router exposes an OpenAI/Anthropic-compatible LLM proxy protected by an API-key check in Next.js middleware (src/dashboardGuard.js). The middleware only guards the prefixes /v1, /v1beta, /api/v1, and /api/v1beta.

A separate rewrite in next.config.mjs silently maps /codex/:path* to /api/v1/responses. Because the middleware decision runs on the original incoming path, a request to /codex/x passes authorization unchecked and is then forwarded to the same backend that handles authenticated LLM calls.

The backend does not repeat the API-key gate, so the call goes through using the operator's stored provider credentials.

Proof of concept

A working proof-of-concept for CVE-2026-55638 in 9router, with the exact payload below.

http
POST /codex/x HTTP/1.1
Host: target.example.com
Content-Type: application/json
Content-Length: 156

{"model":"fakeoai/x","input":"hello","messages":[{"role":"user","content":"hello"}]}

The root cause is a classic middleware-rewrite race: authorization is evaluated on the pre-rewrite path, but the rewrite happens after that decision is final. The vulnerable guard in src/dashboardGuard.js checks only /v1, /v1beta, /api/v1, and /api/v1beta, so /codex falls through to NextResponse.next().

The patch commit (b282f05) adds /codex to that same PUBLIC_PREFIXES list, ensuring the API-key gate is applied before the rewrite can redirect the request to the backend.

This maps to CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). No credentials or special headers are needed. Any internet-accessible 9router instance on a version before 0.5.2 is exploitable with a single unauthenticated POST.

The fix

Upgrade to 9router 0.5.2 or later. The fix adds /codex to the protected prefix list in src/dashboardGuard.js so the middleware enforces the API-key gate before the next.config.mjs rewrite can forward the request to /api/v1/responses. If you cannot upgrade immediately, remove or restrict the /codex/:path* rewrite rule in next.config.mjs as a temporary mitigation.

Reporter not attributed.

References: [1][2][3][4][5]

Related research