CyberRota Analysis
AI-GeneratedThe vulnerability affects the 9Router AI router and token saver, specifically in versions 0.5.4 and earlier, where the POST /api/auth/oidc/test endpoint improperly handles the user-controlled issuerUrl parameter. This oversight allows unauthenticated attackers to exploit the endpoint to scan internal services and retrieve sensitive OIDC discovery information, such as token endpoints and JWKS URIs, especially when dashboard login is disabled. Organizations using this product should prioritize patching to mitigate the risk of unauthorized access to internal services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.