CVE-2026-55500: 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys…

PriorityP263critical9.9CVSS 3.1

AVNACLPRLUINSCCHIHAH

EPSS

0.39%

31.4th percentile

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
decolua	9router	< 0.4.80	0.4.80
decolua	9router	0 – 0.4.71	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.