{"cve":"CVE-2026-62327","nvd":{"published":"2026-07-13T22:16:52.403","modified":"2026-10-24T22:10:00.210","status":"Deferred","description":"9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata, enabling unauthorized use of connected AI provider accounts, billing fraud, and quota exhaustion.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-306","CWE-522"],"references":["https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86","https://www.vulncheck.com/advisories/9router-unauthenticated-api-key-exposure-via-api-usage-stats","https://github.com/decolua/9router/security/advisories/GHSA-vjc7-jrh9-9j86"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:06.907763985+00:00"},"epss":{"cve":"CVE-2026-62327","score":0.06272,"percentile":0.93528,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vjc7-jrh9-9j86","url":"https://osv.dev/vulnerability/GHSA-vjc7-jrh9-9j86","summary":"9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats","modified":"2026-07-15T02:26:45.233399556Z","packages":[{"ecosystem":"npm","name":"9router","purl":"pkg:npm/9router","ranges":["<=0.4.41"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}