CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint

9Router is a specialized dashboard and router mechanism designed to aggregate AI models and optimize API token usage. To facilitate user federation, the platform integrates OpenID Connect (OICC) client authentication mechanisms.\n\nWhen the dashboard is configured without explicit API key requirements, several testing routes become exposed to unauthenticated external actors. Specifically, the route located at /api/auth/oidc/test can be accessed by issuing direct POST requests over the internet.\n\nBecause this endpoint accepts a user-defined URL parameter to validate identity configurations, the absence of network-level and application-level verification creates a severe Server-Side Request Forgery (SSRF) vector. This exposure allows unauthorized entities to leverage the dashboard server as a proxy to execute arbitrary scan actions and query private hosting infrastructure.

The root cause of this vulnerability lies in the programmatic implementation of the OIDC configuration testing feature across two main files: src/app/api/auth/oidc/test/route.js and src/lib/auth/oidc.js.\n\nDuring execution, the handler at the test endpoint extracts the client-supplied issuerUrl parameter from the HTTP request body. It passes this value directly to the helper function fetchOidcDiscovery() without performing basic hostname validation or protocol filtering.\n\nThe fetchOidcDiscovery() function appends standard OIDC discovery path elements and triggers an outbound network call using the native fetch() interface. Crucially, the system does not resolve the hostname to verify if it maps to restricted subnets before opening the TCP socket.\n\nAs a result of this omission, the server is permitted to communicate with loopback interfaces (e.g., 127.0.0.1), private RFC 1918 subnets (such as 10.0.0.0/8), and link-local addresses. The application then returns parsed configuration metrics directly back to the initiator, serving as a functional network oracle.

The following code illustrates the vulnerable implementation within the OIDC helper utility where the input URL is retrieved and queried directly without isolation:\n\njavascript\n// Vulnerable logic pattern in src/lib/auth/oidc.js\nexport async function fetchOidcDiscovery(issuerUrl) {\n // The input parameter is trusted blindly and string-manipulated\n const discoveryUrl = `${issuerUrl.replace(/\\/+$/, '')}/.well-known/openid-configuration`;\n \n // Outbound fetch is performed directly to the user-supplied endpoint\n const response = await fetch(discoveryUrl);\n return await response.json();\n}\n\n\nTo properly eliminate this vector, developers must perform active DNS resolution and inspect the destination IP structure before executing the HTTP connection block:\n\njavascript\n// Secure implementation involving DNS resolution and CIDR check\nimport dns from 'dns/promises';\nimport { isPrivateIp } from 'ip-address-validator'; // Conceptual secure validation helper\n\nexport async function secureFetchOidcDiscovery(issuerUrl) {\n const parsedUrl = new URL(issuerUrl);\n \n if (parsedUrl.protocol !== 'https:') {\n throw new Error('Only HTTPS connections are accepted');\n }\n \n // Perform standard DNS resolution\n const lookupResult = await dns.lookup(parsedUrl.hostname);\n const resolvedIp = lookupResult.address;\n \n // Prevent interaction with loopback, RFC 1918, or cloud link-local spaces\n if (isPrivateIp(resolvedIp)) {\n throw new Error('Access to specified IP address space is prohibited');\n }\n \n // Construct the query targeting the validated IP directly to prevent DNS rebinding\n const endpointUrl = `https://${resolvedIp}${parsedUrl.pathname}/.well-known/openid-configuration`;\n \n const response = await fetch(endpointUrl, {\n headers: { 'Host': parsedUrl.hostname }\n });\n return await response.json();\n}\n

An unauthenticated remote attacker can exploit this SSRF vulnerability to discover local services or scrape sensitive environment credentials.\n\nmermaid\ngraph LR\n "Attacker" -- "POST /api/auth/oidc/test" --> "9Router Server"\n "9Router Server" -- "Unvalidated fetch()" --> "Internal Target"\n "Internal Target" -- "Data / Error" --> "9Router Server"\n "9Router Server" -- "Reflected Response" --> "Attacker"\n\n\nIn a scenario where the application runs inside an AWS or similar cloud instance, an attacker can construct a payload to query the Instance Metadata Service (IMDSv1) at 169.254.169.254 to extract temporary IAM credentials:\n\nhttp\nPOST /api/auth/oidc/test HTTP/1.1\nHost: victim-9router.internal\nContent-Type: application/json\n\n{\n "issuerUrl": "http://169.254.169.254/latest/meta-data/"\n}\n\n\nAdditionally, an attacker can probe local loopback ports to verify active database microservices, LLM inference endpoints (like Ollama on 11434), or admin control panels that are bound only to the local interface.

The potential consequences of CVE-2026-56677 are significant. The CVSS score of 8.6 reflects low confidentiality impact, but high integrity and low availability impacts because arbitrary state-changing requests can be tunneled via the SSRF vector to internal systems.\n\nIn containerized and Kubernetes environments, the container housing 9Router likely shares a virtual network namespace with other key services. Attackers can leverage the SSRF capability to pivot across internal clusters, reaching internal datastores that do not mandate authentication for local connections.\n\nFinally, if the underlying cloud deployment relies on legacy IMDSv1 structures, the leak of the cloud service role token can lead to a full compromise of the cloud resources associated with the dashboard infrastructure.

Mitigating the vulnerability requires a multi-layered defensive posture involving application changes, configuration updates, and network restrictions.\n\nImmediate operational mitigation is achieved by ensuring authentication rules are active. Administrators must access the dashboard interface, navigate to the 'Endpoint & Key' configurations, and toggle 'Require API key' to 'ON' to prevent unauthenticated interactions.\n\nFor structural defense, deployment teams should configure firewall egress rules to restrict the web container from making outbound requests to localhost addresses or RFC 1918 space, unless explicitly whitelisted for OIDC federation servers.