9Router Authentication Bypass via Spoofable X-9r-Real-Ip Header

9Router trusts the client-supplied X-9r-Real-Ip HTTP header to determine if requests originate from localhost, allowing unauthenticated attackers to bypass API-key requirements on the public LLM API by sending X-9r-Real-Ip: 127.0.0.1. This vulnerability affects deployments where requests reach Next.js directly without the custom-server.js wrapper.

Disclosed 19 June 2026 · Record updated 1 October 2026

Impact

Unauthenticated remote attackers can bypass API-key enforcement on the public LLM API and gain access to the instance owner's configured provider resources.

Our coverage

A single forged badge labeled "127.0.0.1" grants strangers passage through a locked door that should require a unique key, leaving the vault unguarded.

Vulnerabilities

One spoofed header unlocks 9Router's LLM API to strangers

A GitHub advisory says 9Router treats any request carrying an X-9r-Real-Ip header of 127.0.0.1 as local, skipping the API-key check entirely.

22 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-5mj8-gf6m-fhw8