CVE-2026-49352: 9Router Hardcoded JWT Secret Allows Complete Authentication Bypass

Executive Summary

A critical vulnerability (CVSS 9.8) has been identified in 9Router, an AI token-saving API router, affecting versions 0.2.21 through 0.4.43. Tracked as CVE-2026-49352, the flaw stems from a hardcoded fallback JWT secret — 9router-default-secret-change-me — embedded directly in the application source code.

This secret was used as a fallback when no JWT_SECRET environment variable was configured. Attackers who discover this default value (which is publicly visible in the open-source repository) can forge valid auth_token cookies, bypassing authentication entirely and gaining administrative control over the 9Router instance.

Technical Details

Vulnerability Root Cause

JWT tokens in 9Router are signed and verified using a secret key. The vulnerability arises because the following source files contain a hardcoded literal fallback:

• src/app/api/auth/login/route.js
• src/middleware.js
• src/lib/auth/dashboardSession.js (added in later versions)

The affected code pattern follows this logic:

const secret = process.env.JWT_SECRET || '9router-default-secret-change-me';

Any deployment that did not explicitly set the JWT_SECRET environment variable — a common configuration oversight — would silently fall back to this well-known string. Because the secret is publicly documented in the open-source repository, an attacker can:

1. Sign an arbitrary JWT payload with the known secret.
2. Set the forged token as the auth_token cookie.
3. Access all authenticated routes as an administrator.

Impact

The hardcoded secret effectively nullifies the authentication mechanism for any 9Router instance that:

• Was deployed without explicitly configuring JWT_SECRET
• Used default Docker Compose or quick-start configurations that didn't document the variable as required

CVSS Score Breakdown

Affected Versions

Remediation

Upgrade to 9Router v0.4.44 or later, which removes the hardcoded fallback and requires explicit JWT_SECRET configuration, failing startup if not provided.

Immediate Actions for All Instances

1. Rotate JWT secret — Set a strong, unique JWT_SECRET environment variable (minimum 32 random bytes).
2. Invalidate all existing sessions — After rotating the secret, all existing auth_token cookies will be invalidated, forcing re-authentication.
3. Audit access logs — Review logs for any requests using forged tokens (look for admin actions from unexpected IPs or time periods).
4. Upgrade to v0.4.44+ — The patch enforces explicit secret configuration at startup.

Generating a Secure JWT Secret

# Generate a cryptographically secure secret
openssl rand -hex 32

Set the output as the JWT_SECRET environment variable in your deployment configuration.

Detection

Check whether your 9Router deployment is vulnerable:

# Check if JWT_SECRET is set in your environment
docker exec <container-name> printenv JWT_SECRET
 
# If empty or unset, your instance is using the hardcoded fallback

Check for signs of exploitation by looking for admin-level actions in logs that cannot be correlated to legitimate user sessions.

References

• NVD — CVE-2026-49352
• 9Router Project Repository