CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-59801 — 9Router through version 0.4.41 contains an unauthenticated access vulnerability ...

·Source: NIST NVD

Updated:

Executive Summary

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credenti

Analysis

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credentials, OAuth tokens, and API keys, redirect AI traffic to attacker-controlled servers, or cause complete denial of service by deleting all provider connections. CVSS Score: 9.8. Published: 2026-07-13T22:16:48.840.

Indicators of Compromise (1)

CVE (1)
CVE-2026-59801
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

ClickFix's Mushrooming Ecosystem Demands New Defense Tactics

The attack vector is available for rent at scale, and evades AV and EDR, leaving YARA analysis as the best detection option.

Dark Reading
MEDIUMVulnerability

Stablecoin treasury and setttlement platform Velocity raises $38 million

Velocity, the stablecoin treasury and settlement platform bringing enterprises onchain, today announced a $38 million Series A round led by Dragonfly and FirstMark, with participation from Activant Capital, Capital One Ventures, QED Investors, Coinbase Ventures, Wintermute Ventures and Ripple.

Finextra
MEDIUMVulnerability

US: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors

The US Department of Defense announced the immediate suspension of the CMMC Phase II requirements until further review

Infosecurity Magazine