Missing authentication in OmniRoute lets attackers obtain API keys
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
OmniRoute 3.8.50 before 3.8.52 from cheaper-inference lacks authentication on the sync token endpoint. When requireLogin is disabled, an unauthenticated remote attacker can obtain sync tokens through POST /api/sync/tokens (CWE-306). The attacker can then use such a token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, and the tokens remain valid after login is re-enabled.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cheaper-inference | OmniRoute | 3.8.50 to before 3.8.52 | 3.8.52 | Patch available | CNA |
- OmniRoute Vendorcheaper-inference Affected 3.8.50 to before 3.8.52 Fixed in 3.8.52 Patch available CNA
Remediation
Update OmniRoute to version 3.8.52, which fixes the flaw in the affected range from 3.8.50 before 3.8.52. The sources list no vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA OmniRoute (cheaper-inference) Fixed in 3.8.52
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116634
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-fqp9-jcg9-vhfv
References
Other 4
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/sync/tokens/route.ts#L28-L30
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/server/authz/routeGuard.ts#L154-L167
- OmniRoute v3.8.52 Release Notes
- https://github.com/cheaper-inference/OmniRoute
More cheaper-inference vulnerabilities
- TI-2026-82357 Unverified password change in OmniRoute lets token holders take over login CVSS 4.0HIGH 7.0
Sources
- CVE-2026-116634 · CVE Program
- CVE-2026-116634 · NVD
- FIRST EPSS
- GHSA-fqp9-jcg9-vhfv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences