pruva-verify REPRO-2026-00217 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00217/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh 9router npm package >=0.2.21 and <=0.4.41 uses the publicly known hardcoded string '9router-default-secret-change-me' as the fallback JWT secret when the JWT_SECRET environment variable is not set. Any unauthenticated remote attacker can forge a valid auth_token cookie and gain full access to the dashboard and API. Affected code is in src/app/api/auth/login/route.js and src/middleware.js (v0.2.21-v0.4.30) and src/lib/auth/dashboardSession.js (v0.4.31-v0.4.41). Fixed in 0.4.45. Target: run 9router without JWT_SECRET, sign a JWT with the known secret, set it as auth_token cookie, and access /dashboard.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.