7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55501

CVE-2026-55501: 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-limit bucket, bypass the 5-attempt threshold and progressive lockout durations, and perform unlimited brute-force attempts against the dashboard password. This issue is fixed in version 0.4.80.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55501

CVE-2026-55501:

7.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
9router	npm	<= 0.4.71	0.4.77

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incorrect handling of the client's IP address for rate-limiting purposes. The getClientIp function in src/lib/auth/loginLimiter.js improperly trusts the user-controllable X-Forwarded-For header. This allows an attacker to bypass the brute-force protection of the login form. The POST function in src/app/api/auth/login/route.js is the API endpoint that consumes the vulnerable getClientIp function, making it the entry point for the attack. The patch addresses this by introducing a custom-server.js that intercepts requests, extracts the real IP address from the socket, and places it in a trusted header (x-9r-real-ip). The getClientIp function was modified to prioritize this new trusted header, effectively ignoring any spoofed X-Forwarded-For headers unless the server is explicitly configured to trust a proxy.

Vulnerable functions

getClientIp

src/lib/auth/loginLimiter.js

The `getClientIp` function incorrectly determines the client's IP address by trusting the `x-forwarded-for` HTTP header. An attacker can easily spoof this header, providing a different value for each request to bypass the rate-limiting mechanism, as each request will be treated as coming from a new IP address.

POST

src/app/api/auth/login/route.js

This is the main API route for handling login attempts. It uses the spoofable IP address returned by `getClientIp` to check for and record failed login attempts (`checkLock`, `recordFail`). An attacker would repeatedly send requests to this endpoint to perform a brute-force attack, and this function would be the entry point in the stack trace for each of those attempts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.