CVE-2026-116634
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Risk Assessment
An attacker could obtain sensitive provider credentials and API keys, potentially leading to unauthorized access to external services. Because tokens persist after login is re-enabled, the risk remains even after configuration changes.
Recommendation
Upgrade OmniRoute to version 3.8.52 or later. Revoke all existing sync tokens and review API keys for potential unauthorized use.
Other vulnerabilities in OmniRoute
See all- CVE-2026-118984Medium
OmniRoute versions 3.8.0 before 3.8.52 contain an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
- CVE-2026-88062Critical
In OmniRoute 3.8.49 and earlier, the POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSync executed the selected interpreter and arguments. With requireLogin=false or during a fresh-instance bootstrap window, a remote anonymous request could execute arbitrary code in the server container.
Original NVD description (English source)
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS