CVE-2026-62327

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-62327

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62327.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-62327

Aliases

Published

2026-07-13T21:37:51.416Z

Modified

2026-07-16T03:48:47.579641020Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

Details

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62327.json",
    "cwe_ids": [
        "CWE-306",
        "CWE-522"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/decolua/9router

Affected ranges

Type

GIT

Repo

https://github.com/decolua/9router

Events

Introduced

Fixed

cebc72e3438dca5aad69b2828cb0d0f2e54b168d

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.4.41"
        },
        {
            "introduced": "9Router"
        },
        {
            "fixed": "0.4.41"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.2.21

v0.2.27

v0.2.31

v0.2.36

v0.2.43

v0.2.52

v0.2.56

v0.2.67

v0.2.70

v0.2.71

v0.2.79

v0.2.89

v0.3.17

v0.3.34

v0.3.42

v0.3.47

v0.3.75

v0.3.83

v0.3.86

v0.3.87

v0.3.89

v0.3.90

v0.3.91

v0.3.97

v0.3.98

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.16

v0.4.18

v0.4.19

v0.4.2

v0.4.20

v0.4.25

v0.4.27

v0.4.28

v0.4.29

v0.4.3

v0.4.30

v0.4.31

v0.4.33

v0.4.36

v0.4.37

v0.4.38

v0.4.39

v0.4.4

v0.4.6

v0.4.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62327.json"