Medium severity · published Oct 29, 2026
CVE-2026-118984
OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
New
5.5
CVSS
–
EPSS
No
On KEV
Description
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
OmniRoute · cheaper-inference
3.8.0 before 3.8.52 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118984
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118984
github.com
https://github.com/cheaper-inference/OmniRoute
github.com
https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130
github.com
https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422
github.com
https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6
github.com
https://github.com/cheaper-inference/OmniRoute/pull/16897
github.com
https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
More from OmniRoute
5.9
CVE-2026-116634
OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens