CVE-2026-56682: 9Router Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
Summary
CVE-2026-56682: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header. Affects 9router versions < 0.5.8. Fixed in 0.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
9Router is an open-source application designed to manage network routing and provide a dashboard for administrative tasks. It includes features such as user authentication and login management. However, it has a vulnerability that allows attackers to bypass brute-force protection mechanisms, making it susceptible to unauthorized access.
Vulnerability Detail
The vulnerability arises from the way 9Router handles login attempts. It uses the X-9r-Real-Ip header, which is client-controllable, to track failed login attempts. This design flaw allows attackers to spoof this header, effectively creating a new rate-limit bucket for each request. As a result, they can attempt unlimited password guesses without triggering the lockout mechanism, leading to potential account compromise.
How To Fix
Minimum fixed version
0.5.8
This is the first release that contains the fix.
npm install 9router@0.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy that strips or rejects any inbound client-supplied X-9r-* headers before they reach the application. This will prevent attackers from manipulating the X-9r-Real-Ip header.
Conclusion
The CVE-2026-56682 vulnerability in 9Router poses a significant risk by allowing attackers to bypass login protections through header spoofing. It is crucial to update to the patched version to mitigate this risk and protect sensitive data.
See every vulnerability recorded for 9router →
FAQ
The vulnerability allows attackers to bypass brute-force protection by spoofing the X-9r-Real-Ip header, enabling unlimited login attempts.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If exploited, this vulnerability can lead to unauthorized access to the 9Router dashboard, allowing attackers to compromise accounts and access sensitive information.
Yes, a patch is available in version 0.5.8 of the 9Router package. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for 9router.
