CVE-2026-62327
published 2026-07-13CVE-2026-62327: 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for…
PriorityP263critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.37%
29.2th percentile
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| decolua | 9router | <= 0.4.41 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
decolua 9Router up to 0.4.41 API Route /api/usage/stats missing encryption
vuldb·2026-07-14·CVSS 9.1
CVE-2026-62327 [CRITICAL] decolua 9Router up to 0.4.41 API Route /api/usage/stats missing encryption
A vulnerability, which was classified as problematic, has been found in decolua 9Router up to 0.4.41. This impacts an unknown function of the file /api/usage/stats of the component API Route. This manipulation causes missing encryption of sensitive data.
This vulnerability is handled as CVE-2026-62327. The attack can be initiated remotely. There is not any exploit available.
GHSA
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sen
ghsa_unreviewed·2026-07-14
CVE-2026-62327 [CRITICAL] CWE-306 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sen
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-13
Published