---
id: CVE-2026-118984
title: >-
  OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via
  /api/settings/require-login
summary: >-
  OmniRoute 3.8.0 before 3.8.52 contains an unverified password change
  vulnerability that allows holders of manage- or admin-scoped API keys or oma_
  access tokens to change the management password without the current password.
  Attackers ca…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-620
vendor: cheaper-inference
product: OmniRoute
affected:
  - OmniRoute >= 3.8.0 < 3.8.52
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T12:20:39.806428Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T12:36:53.458Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118984'
references:
  - url: 'https://github.com/cheaper-inference/OmniRoute/pull/16897'
    label: 'Pull Request #16897'
  - url: >-
      https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6
    label: Patch Commit
  - url: >-
      https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130
  - url: >-
      https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422
  - url: 'https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52'
    label: OmniRoute v3.8.52 Release Notes
  - url: 'https://github.com/cheaper-inference/OmniRoute'
  - url: >-
      https://www.vulncheck.com/advisories/omniroute-3.8.0-before-3.8.52-unverified-password-change-via-api-settings-require-login
    label: >-
      VulnCheck Advisory: OmniRoute 3.8.0 before 3.8.52 Unverified Password
      Change via /api/settings/require-login
tags:
  - cve.org
epss: 0.00381
epssPercentile: 0.32267
ingestedAt: '2026-11-01T18:59:04.468Z'
---

## Overview

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

## Affected

- `OmniRoute >= 3.8.0 < 3.8.52`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.