Vulnerability · Published Oct 29, 2026 · Assigned by VulnCheck

CVE-2026-118984OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

Medium 5.5

In plain English

A medium-severity security flaw in OmniRoute from cheaper-inference. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 67.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

Affected products (as reported)

Vendor	Product	Versions
cheaper-inference	OmniRoute	3.8.0 – before 3.8.52

Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

References

Pull Request #16897 patch, issue-tracking
Patch Commit patch
https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130 technical-description
https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422 technical-description
OmniRoute v3.8.52 Release Notes release-notes
https://github.com/cheaper-inference/OmniRoute product
VulnCheck Advisory: OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login third-party-advisory