Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-49352.
Upgrade to ProDetect 9router Hardcoded Default JWT Secret Authentication Bypass (CVE-2026-49352) in Microsoft Sentinel
Detects exploitation attempts against 9router (npm package) versions 0.2.21 through 0.4.41, which ship a hardcoded default fallback JWT signing secret (CWE-798). When an operator fails to override the default secret, an attacker can forge arbitrary JWTs (including admin/privileged claims) and bypass authentication entirely. Detection focuses on identifying JWTs signed with the known-public default secret, anomalous authentication success patterns following token forgery, and process/network indicators consistent with public PoC exploitation against 9router deployments.
MITRE ATT&CK
KQL Detection Query
// Requires custom table/ingestion of 9router application/auth logs (AppServiceHTTPLogs or custom Log Analytics table 'NineRouterAuthLog_CL')
let SuspiciousUA = dynamic(["python-requests","curl","jwt_tool","PyJWT"]);
NineRouterAuthLog_CL
| where TimeGenerated > ago(24h)
| where isnotempty(JwtHeaderAlg_s) and JwtHeaderAlg_s in ("HS256","HS384","HS512")
| extend SuspiciousClient = ClientUserAgent_s in~ (SuspiciousUA)
| where AuthResult_s == "success" and (isempty(PriorSessionId_s) or SuspiciousClient)
| project TimeGenerated, SrcIpAddr_s, ClientUserAgent_s, JwtSubject_s, JwtIssuer_s, AuthResult_s, RequestUri_s
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), AttemptCount=count() by SrcIpAddr_s, JwtSubject_s, ClientUserAgent_s
| where AttemptCount >= 1Flags successful authentications to 9router where the JWT was issued/validated without a prior legitimate session, or where the client used tooling commonly associated with JWT forgery PoCs.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate automated API clients using curl/python for integration testing
- Load balancers or health checks that mimic bot user agents
- Newly onboarded service accounts without prior session history
Other platforms for CVE-2026-49352
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Forge JWT using published default secret
Expected signal: Application auth log entry showing a successful authentication event with HS256 JWT and admin role claim, with no prior session record for the subject.
- Test 2Simulate JWT forgery tooling user agent
Expected signal: HTTP access log and application auth log capturing the jwt_tool user agent string alongside an authentication attempt.
- Test 3Validate unrotated default secret configuration
Expected signal: File access/read event on the 9router config file captured by EDR or file integrity monitoring.
- Test 4Windows PowerShell JWT forgery and replay
Expected signal: Windows PowerShell script block logging (Event ID 4104) capturing the token generation, plus 9router application auth log for the replayed request.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-49352 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month