{
  "claim": {
    "argus_claim_ref": null,
    "attacker_control": "unauthenticated remote attacker sets auth_token cookie containing JWT signed with hardcoded secret",
    "claimed_surface": "api_remote",
    "expected_impact": "authz_bypass",
    "finding_id": null,
    "id": null,
    "required_entrypoint_detail": "/dashboard and API via auth_token cookie",
    "required_entrypoint_kind": "endpoint",
    "submission_reason": "ticket_derived_llm",
    "trigger_class": "service_api",
    "upstream_verdicts": {
      "claim_extraction": {
        "confidence": "high",
        "model": "accounts/fireworks/models/kimi-k2p7-code",
        "reason": "Ticket explicitly describes a hardcoded JWT fallback secret, unauthenticated remote attacker forging auth_token cookie, and target reproduction: run without JWT_SECRET, sign JWT with known secret, set cookie, access /dashboard.",
        "source": "llm"
      }
    }
  },
  "latest_description": "9router npm package >=0.2.21 and <=0.4.41 uses the publicly known hardcoded string '9router-default-secret-change-me' as the fallback JWT secret when the JWT_SECRET environment variable is not set. Any unauthenticated remote attacker can forge a valid auth_token cookie and gain full access to the dashboard and API. Affected code is in src/app/api/auth/login/route.js and src/middleware.js (v0.2.21-v0.4.30) and src/lib/auth/dashboardSession.js (v0.4.31-v0.4.41). Fixed in 0.4.45. Target: run 9router without JWT_SECRET, sign a JWT with the known secret, set it as auth_token cookie, and access /dashboard.",
  "product": "9router",
  "severity": "critical",
  "status": "open",
  "summary": "9router hardcoded default fallback JWT secret allows authentication bypass",
  "ticket_id": "CVE-2026-49352"
}