Description
9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
decolua 9router
>= 0.2.21, < 0.4.44affected