GHSA-jphh-m39h-6gwx 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

• npm 9router: >= 0.2.21, < 0.4.45 → fixed in 0.4.45

Summary 9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT secret for all Dashboard session JWTs when the `JWT_SECRET` environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, any unauthenticated remote attacker can forge a valid `auth_token` cookie and gain full access to dashboard and api (If JWT_SECRET is not set on server) . This vulnerable affected so many public 9router server Details | Versions | File | Note | |---|---|---| | `>= 0.2.21, = 0.4.31, /dashboard` - completely authentication bypass Attack Scenario: • Attacker can use this JWT to spray to all server that they found in the internet and gain dashboard access if a server doesn't set JWT_SECRET • Then they can steal valuable API Key , Auth Token via http:// target /api/settings/database Impact • A successful attack grants attacker full API Key, Auth Token that 9router hold • They can read 9router apikey, change 9router password ,shutdown 9router, Modify everything • Pivot via the MCP stdio→SSE bridge exposed at `/api/mcp/` (exploit CVE-2026-46339) Recommended Fix Require `JWT_SECRET` at startup and fail fast rather than falling back silently: ```js const jwtSecret = process.env.JWT_SECRET; if (!jwtSecret) { throw new Error( "JWT_SECRET environment variable is not set. " + "Generate one with: openssl rand -hex 32" ); } const SECRET = new TextEncoder().encode(jwtSecret); ``` Alternatively, auto-generate a random secret on first boot and persist it to the data directory — but never fall back to a publicly known constant.