CVE-2026-55501 Vulnerability Analysis & Exploit Details

CVE-2026-55501 Vulnerability Summary

CVE-2026-55501: 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.

CVE-2026-55501 References

External References

• https://github.com/decolua/9router/commit/7648c3412b403a29f04967c4b4e9725e228791d4
• https://github.com/decolua/9router/releases/tag/v0.4.80
• https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7
• https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7

CWE Common Weakness Enumeration

CAPEC Common Attack Pattern Enumeration and Classification

• Dictionary-based Password Attack CAPEC-16 An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern. Dictionary Attacks differ from similar attacks such as Password Spraying (CAPEC-565) and Credential Stuffing (CAPEC-600), since they leverage unknown username/password combinations and don't care about inducing account lockouts.
• Password Brute Forcing CAPEC-49 An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password.
• Use of Known Domain Credentials CAPEC-560 An adversary guesses or obtains (i.e. steals or purchases) legitimate credentials (e.g. userID/password) to achieve authentication and to perform authorized actions under the guise of an authenticated user or service.
• Password Spraying CAPEC-565 In a Password Spraying attack, an adversary tries a small list (e.g. 3-5) of common or expected passwords, often matching the target's complexity policy, against a known list of user accounts to gain valid credentials. The adversary tries a particular password for each user account, before moving onto the next password in the list. This approach assists the adversary in remaining undetected by avoiding rapid or frequent account lockouts. The adversary may then reattempt the process with additional passwords, once enough time has passed to prevent inducing a lockout.
• Credential Stuffing CAPEC-600 An adversary tries known username/password combinations against different systems, applications, or services to gain additional authenticated access. Credential Stuffing attacks rely upon the fact that many users leverage the same username/password combination for multiple systems, applications, and services.
• Use of Known Kerberos Credentials CAPEC-652 An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
• Use of Known Operating System Credentials CAPEC-653 An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System.

Other 5 Recently Published CVEs Vulnerabilities

• CVE-2026-59193 – Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially craft...
• CVE-2026-59190 – grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authentic...
• CVE-2026-59180 – Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior ...
• CVE-2026-59162 – Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values ...
• CVE-2026-59161 – Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Row...