H3-2026-1097¶

9Router IP Spoofing Authentication Bypass

Description¶

9Router trusts the client supplied x-9r-real-ip header, falling back to the Host header, to determine whether an incoming request originates from the local machine. Remote attackers can set x-9r-real-ip to 127.0.0.1 to make the application treat an external request as local. Requests recognized as local reach the LOCAL_ONLY_PATHS route group, which skips the API key check applied to all other requests, including the admin password reset endpoint. The condition affects 9Router versions prior to 0.5.55, before a per-process peer token was introduced to validate the claimed local origin.

Impact¶

Remote attackers can reset the administrator password without providing any credential. This grants full control of the 9Router instance, including every configured upstream API key and proxy rule. Downstream services relying on those proxied API keys inherit the compromise. Any 9Router deployment reachable from an untrusted network faces complete takeover.

References¶

• 9Router Security Advisory GHSA-pjm4-8fpg-f9p6
• 9Router Fix Commit 92259214
• 9Router Release v0.5.55