GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with npm audit (or: npm ls <package>).
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version:

Summary

Multiple critical API security vulnerabilities were discovered in 9Router's Next.js dashboard. The /api/providers endpoints lack authentication entirely, allowing anyone to create, read, update, and delete provider connections. Additionally, /api/usage/stats exposes full plaintext API keys, and /api/usage/request-logs + /api/usage/request-details expose all users' request history and full conversation contents (including system prompts, user messages, assistant responses) without authentication.

Affected Endpoints

| Endpoint | Method | Issue | |---|---|---| | /api/providers | GET | Lists all provider connections with partial credentials, OAuth tokens, account IDs | | /api/providers/:id | GET | Read any single provider detail (IDOR) | | /api/providers | POST | Create arbitrary provider connections with attacker-controlled API keys | | /api/providers/:id | PUT | Modify any existing provider connection | | /api/providers/:id | DELETE | Delete any provider connection | | /api/usage/stats | GET | Exposes full plaintext API keys, per-account usage breakdown, cost data | | /api/usage/request-logs | GET | Exposes all users' request logs (model, tokens, cost, timestamp, provider) | | /api/usage/request-details/:id | GET | Exposes full conversation turns including system prompts, user messages, assistant responses | | /api/version | GET | Exposes current version info | | /api/models | GET | Exposes full model routing catalog | | /api/v1/models | GET | Exposes model list |

Impact

Critical: Provider CRUD without authentication

An attacker can: 1. Add a malicious provider — inject a provider that proxies through their server, capturing all prompts, responses, and API keys routed through 9Router 2. Modify existing providers — replace API keys with attacker-controlled ones, redirect traffic 3. Delete all providers — cause complete denial of service 4. Read all provider configurations — harvest partial credentials, GitHub Copilot OAuth tokens, Cloudflare account IDs, email addresses

CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sources and references

1. GitHub Advisory GHSA-vjc7-jrh9-9j86 github.com
2. github.com github.com

Critical npm advisories · Today’s Security Digest