EXECUTIVE SUMMARY:
CVE-2026-55501 with a CVSS score of 7.3 is a high-severity authentication bypass vulnerability affecting the npm/9router package, specifically versions 0.4.71 and earlier. This technical flaw stems from the dashboard login rate limiter improperly deriving client identity from the attacker-controlled `X-Forwarded-For` HTTP header without verifying the request source. A remote attacker can exploit this issue by sending repeated login requests while rotating the spoofed `X-Forwarded-For` value, provided the application is directly exposed or situated behind a reverse proxy that fails to sanitize untrusted headers. This manipulation allows the attacker to receive a fresh rate-limit bucket for every request, effectively neutralizing brute-force protection thresholds and the progressive login lockout mechanism. Consequently, the attacker gains the ability to conduct unlimited password guessing attempts, drastically increasing the likelihood of unauthorized administrative access or full system compromise. Exploitation is contingent upon the deployment configuration allowing the application to trust forwarding headers originating from external, untrusted network locations.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-55501 with a CVSS score of 7.3 is a high-severity authentication bypass vulnerability affecting the npm/9router package, specifically versions 0.4.71 and earlier. This technical flaw stems from the dashboard login rate limiter improperly deriving client identity from the attacker-controlled `X-Forwarded-For` HTTP header without verifying the request source. A remote attacker can exploit this issue by sending repeated login requests while rotating the spoofed `X-Forwarded-For` value, provided the application is directly exposed or situated behind a reverse proxy that fails to sanitize untrusted headers. This manipulation allows the attacker to receive a fresh rate-limit bucket for every request, effectively neutralizing brute-force protection thresholds and the progressive login lockout mechanism. Consequently, the attacker gains the ability to conduct unlimited password guessing attempts, drastically increasing the likelihood of unauthorized administrative access or full system compromise. Exploitation is contingent upon the deployment configuration allowing the application to trust forwarding headers originating from external, untrusted network locations.[emaillocker id="1283"]
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-7cfm-pqrj-xgq7