{"id":"CVE-2026-118984","title":"OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login","summary":"OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers ca…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-620"],"vendor":"cheaper-inference","product":"OmniRoute","affected":["OmniRoute >= 3.8.0 < 3.8.52"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T12:20:39.806428Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T12:36:53.458Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118984","references":[{"url":"https://github.com/cheaper-inference/OmniRoute/pull/16897","label":"Pull Request #16897"},{"url":"https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6","label":"Patch Commit"},{"url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130"},{"url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422"},{"url":"https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52","label":"OmniRoute v3.8.52 Release Notes"},{"url":"https://github.com/cheaper-inference/OmniRoute"},{"url":"https://www.vulncheck.com/advisories/omniroute-3.8.0-before-3.8.52-unverified-password-change-via-api-settings-require-login","label":"VulnCheck Advisory: OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login"}],"tags":["cve.org"],"epss":0.00381,"epssPercentile":0.32267,"ingestedAt":"2026-11-01T18:59:04.468Z","slug":"CVE-2026-118984","body":"## Overview\n\nOmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.\n\n## Affected\n\n- `OmniRoute >= 3.8.0 < 3.8.52`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}