9router's LLM proxy can be reached with no key at all, through a Host header or a /codex path rewrite
Two high-severity advisories published 28 August against 9router, an OpenAI/Anthropic-compatible LLM gateway. CVE-2026-55641: the request guard decides a caller is local by reading the client-controlled Host header, and since the server binds 0.0.0.0 by default while the CLI prints 'localhost', any remote attacker sending Host: localhost gets /v1 proxy access with no API key, no CLI token and no login, plus unauthenticated SSRF through the built-in noAuth searxng provider. CVE-2026-55638: the Next.js middleware authorizes on the pre-rewrite path, and /codex/* is absent from the protected prefix list but rewrites to the same /api/v1/responses backend, so that path also bypasses the key gate. Both turn the operator's stored paid provider credentials into an open relay.
↳ Follow the thread