CVE-2026-10269

MEDIUM 6.3

decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capable of addressing this issue. The identifier of the patch is 428e2c045cb9c0eb8080e8b580471a9c2eaa95ca. Upgrading the affected component is recommended.

CWE	CWE-285 CWE-266
Vendor	decolua
Product	9router
Published	Jun 1, 2026
Last Updated	Jun 1, 2026

Stay Ahead of the Next One

Get instant alerts for decolua 9router

Be the first to know when new medium vulnerabilities affecting decolua 9router are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

decolua / 9router

0.1 0.2 0.3 0.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/367548 vuldb.com: https://vuldb.com/vuln/367548/cti vuldb.com: https://vuldb.com/cve/CVE-2026-10269 vuldb.com: https://vuldb.com/submit/825188 github.com: https://github.com/decolua/9router/issues/742 github.com: https://github.com/decolua/9router/commit/428e2c045cb9c0eb8080e8b580471a9c2eaa95ca github.com: https://github.com/decolua/9router/releases/tag/v0.4.1 github.com: https://github.com/decolua/9router/

Credits

🔍 brad (VulDB User)