Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: cheaper-inference Clear all filters
TI-2026-82357 CVE-2026-118984 · GHSA-3625-cmv6-g9c2

Unverified password change in OmniRoute lets token holders take over login

Priority LOW 31

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current passw…

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00381 Published 2026-10-29 Fixed in 3.8.52 CWE-620
TI-2026-80546 CVE-2026-116634 · GHSA-fqp9-jcg9-vhfv

Missing authentication in OmniRoute lets attackers obtain API keys

Priority LOW 36

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00499 Published 2026-10-26 Fixed in 3.8.52 CWE-306