9router's key check trusts a header attackers control

9router ships two ways to skip its own key check, per two GitHub advisories published August 28. Both turn the operator's paid OpenAI and Anthropic credentials into a relay anyone can use free, with no key, no CLI token, no login.

The first bug is a trust problem. 9router decides whether a caller is local by reading the Host header, a value the client sends and controls. The server binds to 0.0.0.0 by default, open to the network, while the CLI still prints "localhost" as if it were talking about itself. Send a request with Host: localhost from anywhere, and the guard waves it through to /v1 with no API key, no CLI token, no login. GitHub's advisory covers a second hole too. The built-in searxng provider runs with no authentication, open to SSRF.

The second bug is a routing problem. The Next.js middleware checks auth against the request path before Next.js rewrites it. The protected-prefix list doesn't include /codex/*, but that path rewrites internally to the same /api/v1/responses backend the guarded routes hit. Land on that backend through the unlisted path and the check never runs.

Operators running 9router anywhere reachable outside localhost need the patched version. Confirm it covers both the Host-trust bug and the middleware-ordering bug, since either one alone is enough to drain a key.

Neither advisory says how long the flaws shipped before someone found them, or how many deployments sat exposed to the open internet in the meantime.