CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-62327 — 9Router through version 0.4.41 contain an unauthenticated information disclosure...

·Source: NIST NVD

Updated:

Executive Summary

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside to

Analysis

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion. CVSS Score: 9.1. Published: 2026-07-13T22:16:52.403.

Indicators of Compromise (1)

CVE (1)
CVE-2026-62327
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

ClickFix's Mushrooming Ecosystem Demands New Defense Tactics

The attack vector is available for rent at scale, and evades AV and EDR, leaving YARA analysis as the best detection option.

Dark Reading
MEDIUMVulnerability

Stablecoin treasury and setttlement platform Velocity raises $38 million

Velocity, the stablecoin treasury and settlement platform bringing enterprises onchain, today announced a $38 million Series A round led by Dragonfly and FirstMark, with participation from Activant Capital, Capital One Ventures, QED Investors, Coinbase Ventures, Wintermute Ventures and Ripple.

Finextra
MEDIUMVulnerability

US: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors

The US Department of Defense announced the immediate suspension of the CMMC Phase II requirements until further review

Infosecurity Magazine