CVE-2026-59801
CriticalPublic exploit9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under…
Published Jul 13, 2026 · Updated Aug 12, 2026 · Also known as EUVD-2026-43559, GHSA-vjc7-jrh9-9j86, TR-26-0549
Key Facts
Patch immediately- CVE-2026-59801 is a critical-severity vulnerability (CVSS 9.3 v4) affecting 9Router (npm).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.9% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v4
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
2.9%
Higher than 86.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-59801 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| 9Routernpm | See advisory | n/a |
Timeline
Publicly disclosed
Jul 13, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-306 Missing Authentication for Critical Function
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
- CWE-522 Insufficiently Protected Credentials
- CWE-862 Missing Authorization
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59801.json
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62327.json
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62328.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-59801
FAQ
Common Questions.
9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*.
Affected: 9Router (npm). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-59801 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo