Vulnerability Description
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/cheaper-inference/OmniRoute
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff
- https://github.com/cheaper-inference/OmniRoute/commit/44a29611bf088e351d8d40eaca
- https://github.com/cheaper-inference/OmniRoute/pull/17053
- https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
- https://www.vulncheck.com/advisories/omniroute-3.8.50-before-3.8.52-missing-auth
FAQ
What is CVE-2026-116634?
CVE-2026-116634 is a vulnerability with a CVSS score of 5.9 (MEDIUM). OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attac...
How severe is CVE-2026-116634?
CVE-2026-116634 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116634?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.