high8.7
CVE-2026-56679
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Impact
9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys and /api/providers to unauthenticated access. This issue is reported as fixed in version 0.5.4.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | 9router | <= 0.5.2 | 0.5.4 |