CVE-2026-49352

9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352)

Initial Access Privilege Escalation Defense Evasion Credential Access Last updated:

Detects exploitation attempts against 9router (npm package) versions 0.2.21 through 0.4.41, which ship a hardcoded default fallback JWT signing secret (CWE-798). When an operator fails to override the default secret, an attacker can forge arbitrary JWTs (including admin/privileged claims) and bypass authentication entirely. Detection focuses on identifying JWTs signed with the known-public default secret, anomalous authentication success patterns following token forgery, and process/network indicators consistent with public PoC exploitation against 9router deployments.

Vulnerability Intelligence

Public PoC

Affected Software

Vendor
npm
Product
9router
Versions
>= 0.2.21, <= 0.4.41

Weakness (CWE)

CWE-798

Timeline

Disclosed
July 2, 2026

CVSS

9.8
Critical (9.0–10)
CVSS vector not yet published
Read the write-up →

What is CVE-2026-49352 9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352)?

9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352) (CVE-2026-49352) maps to the Initial Access and Privilege Escalation and Defense Evasion and Credential Access tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for 9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352), covering the data sources and telemetry it touches: Application Logs, Authentication Logs. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion Credential Access
Microsoft Sentinel / Defender
kusto 
// Requires custom table/ingestion of 9router application/auth logs (AppServiceHTTPLogs or custom Log Analytics table 'NineRouterAuthLog_CL')
let SuspiciousUA = dynamic(["python-requests","curl","jwt_tool","PyJWT"]);
NineRouterAuthLog_CL
| where TimeGenerated > ago(24h)
| where isnotempty(JwtHeaderAlg_s) and JwtHeaderAlg_s in ("HS256","HS384","HS512")
| extend SuspiciousClient = ClientUserAgent_s in~ (SuspiciousUA)
| where AuthResult_s == "success" and (isempty(PriorSessionId_s) or SuspiciousClient)
| project TimeGenerated, SrcIpAddr_s, ClientUserAgent_s, JwtSubject_s, JwtIssuer_s, AuthResult_s, RequestUri_s
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), AttemptCount=count() by SrcIpAddr_s, JwtSubject_s, ClientUserAgent_s
| where AttemptCount >= 1

Flags successful authentications to 9router where the JWT was issued/validated without a prior legitimate session, or where the client used tooling commonly associated with JWT forgery PoCs.

critical severity medium confidence

Data Sources

Application Logs Authentication Logs

Required Tables

NineRouterAuthLog_CL

False Positives

  • Legitimate automated API clients using curl/python for integration testing
  • Load balancers or health checks that mimic bot user agents
  • Newly onboarded service accounts without prior session history

Sigma rule & cross-platform mapping

The detection logic for 9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352) (CVE-2026-49352) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-49352 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-49352

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-08-01 Research depth: standard
References (2)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Forge JWT using published default secret

    Expected signal: Application auth log entry showing a successful authentication event with HS256 JWT and admin role claim, with no prior session record for the subject.

  2. Test 2Simulate JWT forgery tooling user agent

    Expected signal: HTTP access log and application auth log capturing the jwt_tool user agent string alongside an authentication attempt.

  3. Test 3Validate unrotated default secret configuration

    Expected signal: File access/read event on the 9router config file captured by EDR or file integrity monitoring.

  4. Test 4Windows PowerShell JWT forgery and replay

    Expected signal: Windows PowerShell script block logging (Event ID 4104) capturing the token generation, plus 9router application auth log for the replayed request.

Response Playbook

Triage

  1. Confirm the deployed 9router version via package.json/lockfile or npm ls 9router; versions >=0.2.21 and <=0.4.41 are vulnerable to the hardcoded default JWT secret.
  2. Check whether the JWT_SECRET (or equivalent config) environment variable/config value has been explicitly overridden from the library default; if unset, treat the instance as trivially exploitable.
  3. Decode any suspicious JWTs from access logs (jwt.io offline or a local decoder) and attempt to verify the signature against the known public default secret from the GHSA advisory to confirm forgery.
  4. Review authentication logs for successful logins with unusual claims (e.g., elevated roles/admin subjects) that have no corresponding legitimate login event or MFA challenge.

Containment

  1. Immediately rotate/override the JWT signing secret to a strong, randomly generated value and restart the 9router service to invalidate all previously issued tokens.
  2. Revoke all active sessions/tokens issued prior to remediation, and force re-authentication for all users; consider temporarily disabling the affected 9router endpoint if patching cannot occur immediately.
  3. Upgrade 9router to a patched release (>0.4.41 per vendor advisory) as soon as available, verifying the fix removes the hardcoded fallback secret path.

Evidence Collection

  1. Preserve raw HTTP access/application logs covering the suspected exploitation window, including full request/response headers and Authorization bearer tokens.
  2. Export and securely archive any decoded JWT payloads/signatures used to confirm forgery, along with the 9router configuration file/environment showing the JWT secret setting at time of incident.
  3. Capture process and network connection data (EDR telemetry) for the host running 9router to identify any post-auth-bypass lateral movement or data access.

Escalation Criteria

  • ! Escalate to incident response if forged JWTs with administrative/privileged claims were used to authenticate successfully against production systems.
  • ! Escalate if evidence shows the attacker pivoted beyond authentication bypass into data exfiltration, configuration changes, or additional account creation.
  • ! Escalate if the affected 9router instance is internet-facing and the default secret has not yet been rotated, given the 9.8 CVSS and public PoC availability.

Investigation Guide

Forensic Artifacts

  • > Application/auth logs containing JWT bearer tokens, algorithm headers, and claim payloads
  • > 9router runtime configuration or environment showing whether JWT_SECRET was overridden from the library default
  • > Web server/reverse proxy access logs showing source IPs, user agents, and request patterns during the suspected exploitation window

Tuning Guidance

Baseline normal 9router client behavior (expected user agents, session continuity patterns, typical claim structures) for at least one week before enabling this detection in blocking/alerting mode. Suppress or tune out known stateless integrations and CI/CD service accounts that legitimately lack prior session context. Once the JWT secret has been rotated and the package patched, treat any subsequent match as high-confidence malicious since exploitation of the default secret would no longer succeed against remediated systems.

Hunting Queries

Hunts for JWTs carrying privileged role claims that appear without any prior legitimate session, a strong indicator of forged tokens exploiting the hardcoded default secret.

Hunting — KQL
kql 
NineRouterAuthLog_CL
| where TimeGenerated > ago(7d)
| extend Claims = parse_json(JwtPayload_s)
| where Claims.role in ("admin","superuser") and isempty(PriorSessionId_s)
| project TimeGenerated, SrcIpAddr_s, JwtSubject_s, Claims
Hunting — SPL
spl 
index=* sourcetype=9router:auth
| spath input=jwt_payload
| where (role="admin" OR role="superuser") AND isnull(prior_session_id)
| table _time src_ip jwt_subject role

Atomic Red Team Tests

Test 1 Forge JWT using published default secret
linux

Uses a local script to sign a JWT with the publicly known 9router default fallback secret and attempt authentication against a lab instance.

Command

bash 
python3 -c "import jwt,sys; secret=open('default_secret.txt').read().strip(); token=jwt.encode({'sub':'admin','role':'admin'}, secret, algorithm='HS256'); print(token)" > forged_token.txt && curl -s -H "Authorization: Bearer $(cat forged_token.txt)" http://lab-9router.local/api/protected

Cleanup

bash 
rm -f forged_token.txt default_secret.txt

Expected Telemetry

Application auth log entry showing a successful authentication event with HS256 JWT and admin role claim, with no prior session record for the subject.

Expected Detection

kql/spl rules match on successful auth with privileged claims and missing prior session context.

Test 2 Simulate JWT forgery tooling user agent
linux

Sends an authentication request using jwt_tool's default user agent string to simulate exploitation via public PoC tooling against 9router.

Command

bash 
curl -s -A "jwt_tool" -H "Authorization: Bearer <forged_or_test_token>" http://lab-9router.local/api/login

Cleanup

bash 
No persistent changes; clear shell history entry if desired.

Expected Telemetry

HTTP access log and application auth log capturing the jwt_tool user agent string alongside an authentication attempt.

Expected Detection

Detections flagging client_user_agent matches for jwt_tool/PyJWT/python-requests trigger an alert.

Test 3 Validate unrotated default secret configuration
linux

Checks a lab 9router deployment's running configuration/environment to confirm whether the JWT secret still matches the library's hardcoded default, simulating attacker reconnaissance.

Command

bash 
node -e "const cfg=require('/opt/9router/config.js'); console.log('current_secret=' + cfg.jwtSecret);" | tee current_secret_check.txt

Cleanup

bash 
rm -f current_secret_check.txt

Expected Telemetry

File access/read event on the 9router config file captured by EDR or file integrity monitoring.

Expected Detection

File access monitoring or EDR process telemetry flags unauthorized reads of application configuration files containing secret material.

Test 4 Windows PowerShell JWT forgery and replay
windows

On a Windows lab host, forges a JWT with the known default secret using PowerShell and replays it against the 9router API to validate detection coverage on Windows-hosted deployments.

Command

powershell 
powershell -Command "$secret='<default_secret_from_advisory>'; $token = New-JwtToken -Payload @{sub='admin';role='admin'} -Secret $secret -Algorithm HS256; Invoke-WebRequest -Uri 'http://lab-9router.local/api/protected' -Headers @{Authorization=\"Bearer $token\"}"

Cleanup

powershell 
Remove any locally cached token variables from the PowerShell session (exit session or Remove-Variable token,secret).

Expected Telemetry

Windows PowerShell script block logging (Event ID 4104) capturing the token generation, plus 9router application auth log for the replayed request.

Expected Detection

SIEM correlation rule linking PowerShell JWT-crafting activity with a subsequent successful 9router authentication event.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense EvasionTA0006Credential Access

Related Techniques

T1552.001Credentials In FilesT1078Valid AccountsT1550.001Application Access Token

Same Tactic: Initial Access

Popular Detections