CVE-2026-56677: 
JavaScript vulnerability analysis and mitigation

CVE-2026-56677 is a Server-Side Request Forgery (SSRF) vulnerability combined with missing authentication in the 9Router AI router and token saver application. The flaw exists in the POST /api/auth/oidc/test endpoint, which accepts a user-controlled issuerUrl parameter and performs outbound HTTP requests without restricting private or loopback destinations, and without requiring authentication. All versions up to and including 0.5.4 (npm package 9router by decolua) are affected; version 5.6 contains the fix. The vulnerability was first published to the GitHub Advisory Database on July 16, 2026, and reviewed on August 17, 2026, with a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, GHSA).

The root cause is twofold: CWE-918 (Server-Side Request Forgery) and CWE-306 (Missing Authentication for Critical Function). In src/app/api/auth/oidc/test/route.js, the issuerUrl parameter supplied by the client is passed directly to fetchOidcDiscovery() in src/lib/auth/oidc.js, which executes fetch(\${issuerUrl}/.well-known/openid-configuration`)without any host validation or IP blocklist check. The route handler also lacks authentication middleware, meaning any unauthenticated remote actor with network access to the dashboard API can trigger the request. This enables two exploitation modes: (1) **Blind/Error-based SSRF** — probing closed or non-HTTP ports causes the application to return distinguishable error messages (e.g.,{"error":"Unexpected token 'c', "check vul" is not valid JSON"}), confirming TCP connectivity; and (2) **Full Data Feed SSRF** — if the targeted internal service returns a valid OpenID configuration JSON, the backend parses and reflects fields such as token_endpointandjwks_uri` back to the unauthenticated caller (GitHub Advisory, GHSA).

An unauthenticated remote attacker can leverage the 9Router instance as a proxy to conduct internal network topology discovery and port scanning against loopback (127.0.0.0/8) and RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). In the full-data-feed scenario, an attacker can manipulate OIDC configuration fields reflected into the dashboard's application logic, potentially injecting malicious token_endpoint or jwks_uri values that could affect downstream authentication flows. The confidentiality impact is rated Low (internal service metadata exposure), integrity impact is rated High (configuration data manipulation), and availability impact is rated Low (GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication and no user interaction, making it trivially exploitable by any attacker with network access to the 9Router dashboard API. The EPSS score is currently 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or internally accessible 9Router instances (version ≤ 0.5.4) using network scanners or Shodan, targeting the default port (e.g., 3000) and confirming the /api/auth/oidc/test endpoint is reachable without authentication.
2. Craft the SSRF request: Prepare a POST request to /api/auth/oidc/test with a JSON body containing a target internal URL as the issuerUrl parameter — no session cookie or authentication token is required:

POST /api/auth/oidc/test HTTP/1.1
Host: <target>:3000
Content-Type: application/json

{"issuerUrl": "http://127.0.0.1:22", "clientId": "probe_only"}

3. Port scanning (Blind SSRF): Iterate over internal IPs and ports. Closed ports or non-HTTP services return distinguishable error messages (e.g., connection timeout vs. JSON parse error), enabling internal network mapping.
4. Full data feed manipulation: Point issuerUrl at an internal service that returns JSON resembling an OpenID configuration document. The server will parse and reflect token_endpoint, jwks_uri, and other fields back in the HTTP 200 response, confirming full SSRF and enabling potential OIDC configuration poisoning.
5. Leverage results: Use discovered internal service topology for further lateral movement, or inject a malicious token_endpoint URL to redirect authentication token exchanges to an attacker-controlled server (GHSA, GitHub Advisory).

• Network: Outbound HTTP requests from the 9Router server process to internal/private IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses, particularly to /.well-known/openid-configuration paths; unusual TCP connections to non-standard internal ports (e.g., 22, 3306, 5432) originating from the Node.js process.
• Logs: Repeated unauthenticated POST requests to /api/auth/oidc/test in web/application access logs, especially from external or unexpected source IPs; application error log entries containing "Unexpected token" or JSON parse failures referencing internal hostnames or IPs.
• Application Behavior: Responses from /api/auth/oidc/test containing internal IP addresses or hostnames in issuerUrl, tokenEndpoint, or jwksUri fields; discoveryOk: true responses referencing RFC 1918 or loopback addresses.

The vendor has released a patched version: 9router 5.6 (npm package). Users should upgrade immediately from any version ≤ 0.5.4. If an immediate upgrade is not possible, the following mitigations should be applied: (1) add authentication middleware to the /api/auth/oidc/test route handler to require valid user sessions; (2) implement server-side IP resolution and blocklisting to reject requests targeting loopback (127.0.0.0/8, ::1), RFC 1918 private ranges, and link-local addresses; (3) enforce https:// protocol scheme validation on issuerUrl; (4) apply rate limiting to the endpoint; and (5) consider an allowlist of permitted OIDC issuer domains (GHSA, GitHub Advisory).

The vulnerability was reported by security researcher HK4zCzi and published by the decolua maintainer on July 16, 2026, with the GitHub Advisory Database review completed on August 17, 2026. Coverage has appeared on threat intelligence aggregators including VulDB, The Hacker Wire, and GCVE (GitHub Advisory). No significant broader community debate or vendor controversy has been observed.