CVE-2026-49352: Hardcoded Default JWT Secret Lets Attackers Forge Admin Tokens in 9router

What's the vulnerability?

9router, an npm package, ships with a hardcoded fallback JWT signing secret baked into the codebase (CWE-798: Use of Hard-coded Credentials). If an operator deploys 9router without explicitly overriding this default secret, the value used to sign and verify authentication tokens is effectively public knowledge. Anyone who knows the default secret can forge arbitrary JWTs — including tokens carrying admin or otherwise privileged claims — and present them to the application as valid, fully bypassing authentication. This is a complete authentication bypass, reflected in its CVSS score of 9.8.

Affected Software

• Vendor/Ecosystem: npm
• Product: 9router
• Affected versions: >= 0.2.21 and <= 0.4.41

No patched version is currently recorded. Operators running an in-range version should treat any default-secret configuration as vulnerable until a fix is confirmed and applied.

Exploitation Status

A public proof-of-concept exists for this vulnerability. Because the flaw requires no complex chaining — just knowledge of a static default secret — weaponization is straightforward and low-effort for an attacker. Defenders should treat this as actively exploitable in the wild-readiness sense, even absent confirmed KEV listing, and prioritize remediation and monitoring accordingly.

How Our Detection Catches It

Our detection content ships coverage across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the logic focuses on three signal categories:

• Signature verification against the known default secret — identifying JWTs presented to 9router endpoints that validate against the publicly known hardcoded signing key rather than an operator-rotated secret.
• Anomalous authentication success patterns — correlating token forgery indicators with subsequent successful authentication events that deviate from expected user/session baselines (e.g., privileged claims appearing without a corresponding legitimate login flow).
• Process and network indicators of PoC usage — matching behavioral artifacts consistent with publicly available exploit tooling targeting 9router deployments.

Together these give SOC teams multiple independent detection opportunities — at the token-validation layer, the authentication-outcome layer, and the host/network layer — increasing the odds of catching exploitation even if one signal is evaded.

Full Detection Details

For the complete KQL, SPL, and other SIEM queries, MITRE ATT&CK mapping, and additional context, see the full detection page: CVE-2026-49352 on df00tech.