CVE-2026-118984
MediumCVSS 5.5Summary
OmniRoute versions 3.8.0 before 3.8.52 contain an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Risk Assessment
A holder of a relevant API key or token can take over the administrative dashboard or lock out the operator, leading to loss of control over the system.
Recommendation
Update OmniRoute to version 3.8.52 or later. Protect and rotate manage/admin API keys and oma_ tokens and limit their scope.
Other vulnerabilities in OmniRoute
See all- CVE-2026-88062Critical
In OmniRoute 3.8.49 and earlier, the POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSync executed the selected interpreter and arguments. With requireLogin=false or during a fresh-instance bootstrap window, a remote anonymous request could execute arbitrary code in the server container.
- CVE-2026-116634Medium
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Original NVD description (English source)
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS