CVE-2026-118984
Deferred Deferred - Pending Action

Unverified Password Change in OmniRoute 3.8.0

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: VulnCheck

Description
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-118984
EUVD
EUVD-2026-112722

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cheaper-inference OmniRoute 3.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-620 When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OmniRoute 3.8.0 before 3.8.52 has an unverified password change vulnerability. Attackers with manage- or admin-scoped API keys or oma_ access tokens can send POST requests to /api/settings/require-login to change the management password without providing the current password. This allows them to lock out operators, take over dashboard login, or disable login requirements entirely.

Detection Guidance

Check OmniRoute logs for unauthorized POST requests to /api/settings/require-login. Monitor for failed password change attempts or settings modifications from API keys or oma_ tokens. Review audit logs for settings.update_failed events with reason OPERATOR_REQUIRED.

Impact Analysis

This vulnerability allows unauthorized users to change the management password, lock out legitimate users, take over dashboard access, or disable login requirements. This could lead to complete system compromise, loss of control over the OmniRoute instance, and potential exposure of sensitive data or AI provider interactions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. By allowing attackers to disable login requirements or take over accounts, it undermines access controls and audit logging, which are critical for compliance with these regulations.

Mitigation Strategies

Upgrade OmniRoute to version 3.8.52 or later. Revoke all manage- and admin-scoped API keys and oma_ access tokens. Audit and rotate all management passwords. Restrict access to /api/settings endpoints to operator credentials only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart