9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.

Affected: npm: 9router

### Summary

The Kiro API-key validation endpoint builds an upstream URL using a user-controlled `region` value. By supplying a crafted region such as `kiro-canary.local:8443#`, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the constructed `codewhisperer.<region>` hostname. The request forwards the submitted Kiro API key as an `Authorization: Bearer` header.

### Details

- **Affected version / commit:** 9router v0.5.2 @ `5da508a`. - **Endpoint:** `POST /api/oauth/kiro/api-key`. - **Correct runtime payload:** `region: "kiro-canary.local:8443#"`. - Do **not** use the old `@host#` payload (`region: "@kiro-canary.local:8443#"`); it is blocked by Node/undici `fetch()` because it creates URL credentials (`"Request cannot be constructed from a URL that includes credentials"`). - **Constructed upstream host becomes:** `codewhisperer.kiro-canary.local:8443` (the `#` turns the trailing `.amazonaws.com` into a URL fragment). - HTTPS canary captured: `Authorization: Bearer DUMMY_KIRO_API_KEY_FOR_LOCAL_REPRO`. - TLS verification was **not** globally disabled; the reproduction uses a local CA via `NODE_EXTRA_CA_CERTS`. - The no-auth control returns 401, so this standalone issue is **authenticated**. - `SameSite=Lax` on the session cookie prevents cross-site POST cookie delivery, so do **not** claim drive-by CSRF unless another same-site / auth-bypass primitive is chained.

**Root cause.** The route reads `…