Unverified password change in OmniRoute lets token holders take over login
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
OmniRoute 3.8.0 before 3.8.52 lets holders of manage- or admin-scoped API keys or oma_ access tokens change the management password without entering the current password (CWE-620). An attacker with such a token can lock out the operator, take over dashboard login, or disable the login requirement entirely by sending POST requests to /api/settings/require-login. The CVSS 4.0 vector rates it as network-reachable with low complexity and high privileges required.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cheaper-inference | OmniRoute | 3.8.0 to before 3.8.52 | 3.8.52 | Patch available | CNA |
- OmniRoute Vendorcheaper-inference Affected 3.8.0 to before 3.8.52 Fixed in 3.8.52 Patch available CNA
Remediation
Upgrade OmniRoute to version 3.8.52 or later, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA OmniRoute (cheaper-inference) Fixed in 3.8.52
Timeline
- 2026-10-29 Threatist record created from CVE-2026-118984
- 2026-10-29 CISA SSVC decision points changed
- 2026-10-29 Priority changed: MEDIUM → LOW
- 2026-10-29 Alias added: GHSA-3625-cmv6-g9c2
References
Other 4
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422
- OmniRoute v3.8.52 Release Notes
- https://github.com/cheaper-inference/OmniRoute
More cheaper-inference vulnerabilities
- TI-2026-80546 Missing authentication in OmniRoute lets attackers obtain API keys CVSS 4.0HIGH 8.2
Sources
- CVE-2026-118984 · CVE Program
- CVE-2026-118984 · NVD
- FIRST EPSS
- GHSA-3625-cmv6-g9c2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences