{"id":"CVE-2026-116634","title":"OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens","summary":"OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-306"],"vendor":"cheaper-inference","product":"OmniRoute","affected":["OmniRoute >= 3.8.50 < 3.8.52"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T19:29:48.582247Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T19:34:36.562Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116634","references":[{"url":"https://github.com/cheaper-inference/OmniRoute/pull/17053","label":"Pull Request #17053"},{"url":"https://github.com/cheaper-inference/OmniRoute/commit/44a29611bf088e351d8d40eacaabdc1794ed0c61","label":"Patch Commit"},{"url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/sync/tokens/route.ts#L28-L30"},{"url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/server/authz/routeGuard.ts#L154-L167"},{"url":"https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52","label":"OmniRoute v3.8.52 Release Notes"},{"url":"https://github.com/cheaper-inference/OmniRoute"},{"url":"https://www.vulncheck.com/advisories/omniroute-3.8.50-before-3.8.52-missing-authentication-via-api-sync-tokens","label":"VulnCheck Advisory: OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T18:35:51.490Z","epss":0.00499,"epssPercentile":0.42553,"slug":"CVE-2026-116634","body":"## Overview\n\nOmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.\n\n## Affected\n\n- `OmniRoute >= 3.8.50 < 3.8.52`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}