CVE-2026-49352: 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass ### Summary 9router uses a publicly known hardcoded string…

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

### Summary
9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT secret for all Dashboard session JWTs when the `JWT_SECRET` environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, any unauthenticated remote attacker can forge a valid `auth_token` cookie and gain full access to dashboard and api (If JWT_SECRET is not set on server) . This vulnerable affected so many public 9router server
### Details
| Versions | File | Note |
|---|---|---|
| `>= 0.2.21, = 0.4.31, /dashboard` - completely authentication bypass

### Attack Scenario:
- Attacker can use this JWT to spray to all server that they found in the internet and gain dashboard access if a server doesn't set JWT_SECRET
- Then they can steal valuable API Key , Auth Token via http:// target /api/settings/database


### Impact
- A successful attack grants attacker **full API Key, Auth Token** that 9router hold
- They can **read** 9router apikey, **change** 9router password ,shutdown 9router, **Modify** everything
- **Pivot** via the MCP stdio→SSE bridge exposed at `/api/mcp/` (exploit CVE-2026-46339)

## Recommended Fix

**Require** `JWT_SECRET` at startup and fail fast rather than falling back silently:

```js
const jwtSecret = process.env.JWT_SECRET;
if (!jwtSecret) {
throw new Error(
"JWT_SECRET environment variable is not set. " +
"Generate one with: openssl rand -hex 32"
);
}
const SECRET = new TextEncoder().encode(jwtSecret);
```

Alternatively, auto-generate a random secret on first boot and persist it to the data directory — but **never** fall back to a publicly known constant.

Affected