CVE-2026-116634
HIGH
8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
306
Missing Authentication for Critical Function
DraftCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Gain Privileges Or Assume Identity
Varies By Context
Applicable Platforms
Technologies:
Cloud Computing, ICS/OT
https://github.com/cheaper-inference/OmniRoute
https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6f…
https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6f…
https://github.com/cheaper-inference/OmniRoute/commit/44a29611bf088e351d8d40eac…
https://github.com/cheaper-inference/OmniRoute/pull/17053
https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
https://www.vulncheck.com/advisories/omniroute-3.8.50-before-3.8.52-missing-aut…