9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352)

// Requires custom table/ingestion of 9router application/auth logs (AppServiceHTTPLogs or custom Log Analytics table 'NineRouterAuthLog_CL')
let SuspiciousUA = dynamic(["python-requests","curl","jwt_tool","PyJWT"]);
NineRouterAuthLog_CL
| where TimeGenerated > ago(24h)
| where isnotempty(JwtHeaderAlg_s) and JwtHeaderAlg_s in ("HS256","HS384","HS512")
| extend SuspiciousClient = ClientUserAgent_s in~ (SuspiciousUA)
| where AuthResult_s == "success" and (isempty(PriorSessionId_s) or SuspiciousClient)
| project TimeGenerated, SrcIpAddr_s, ClientUserAgent_s, JwtSubject_s, JwtIssuer_s, AuthResult_s, RequestUri_s
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), AttemptCount=count() by SrcIpAddr_s, JwtSubject_s, ClientUserAgent_s
| where AttemptCount >= 1

index=* sourcetype=9router:auth
| eval alg=coalesce(jwt_header_alg, "unknown")
| where alg IN ("HS256","HS384","HS512")
| eval suspicious_ua=if(match(client_user_agent, "(?i)python-requests|curl|jwt_tool|PyJWT"),1,0)
| where auth_result="success" AND (isnull(prior_session_id) OR suspicious_ua=1)
| stats count as attempt_count, min(_time) as first_seen, max(_time) as last_seen by src_ip, jwt_subject, client_user_agent
| where attempt_count>=1
| convert ctime(first_seen) ctime(last_seen)

authentication where event.dataset == "9router.auth" and
  jwt.header.alg in ("HS256", "HS384", "HS512") and
  event.outcome == "success" and
  (source.session.id == null or user_agent.original : ("*python-requests*", "*curl*", "*jwt_tool*", "*PyJWT*"))

SELECT sourceip, username, "JWT Algorithm", "User Agent", eventcount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = '9router'
AND "Auth Result" = 'success'
AND "JWT Algorithm" IN ('HS256','HS384','HS512')
AND ("Prior Session Id" IS NULL OR "User Agent" ILIKE '%python-requests%' OR "User Agent" ILIKE '%curl%' OR "User Agent" ILIKE '%jwt_tool%')
LAST 24 HOURS

_sourceCategory=9router/auth
| json field=_raw "jwt_header_alg" as alg
| json field=_raw "auth_result" as auth_result
| json field=_raw "client_user_agent" as ua
| json field=_raw "prior_session_id" as prior_session
| where alg matches "HS256" or alg matches "HS384" or alg matches "HS512"
| where auth_result = "success"
| where isNull(prior_session) or ua matches "*python-requests*" or ua matches "*curl*" or ua matches "*jwt_tool*"
| count by src_ip, ua
| where _count >= 1

rule ninerouter_jwt_forgery_cve_2026_49352 {
  meta:
    author = "df00tech"
    description = "Detects successful 9router auth via forged JWT using hardcoded default secret (CVE-2026-49352)"
    severity = "CRITICAL"
  events:
    $auth.metadata.event_type = "USER_LOGIN"
    $auth.target.application = "9router"
    $auth.security_result.action = "ALLOW"
    $auth.additional.fields["jwt_header_alg"] = /HS256|HS384|HS512/
    ($auth.additional.fields["prior_session_id"] = "" or
     $auth.network.http.user_agent = /python-requests|curl|jwt_tool|PyJWT/)
  condition:
    $auth
}

#event_simple_name=UserLogon OR #event_simple_name=ApplicationAuthEvent
| ApplicationName="9router"
| AuthResult="success"
| JwtHeaderAlg=/HS256|HS384|HS512/
| test(PriorSessionId="") OR ClientUserAgent=/python-requests|curl|jwt_tool|PyJWT/
| groupBy([SourceIP, ClientUserAgent], function=([count(as=attempt_count)]))
| attempt_count >= 1