Missing Authentication in OmniRoute 3.8.50 and Earlier from Cheaper Inference

CVE-2026-116634

What is CVE-2026-116634?

OmniRoute versions 3.8.50 and earlier have a critical missing authentication vulnerability that allows unauthorized attackers to generate sync tokens via a POST request to /api/sync/tokens when the requireLogin feature is disabled. This exploit enables attackers to leverage the issued tokens to access the GET endpoint /api/sync/bundle, potentially exposing sensitive information such as decrypted provider credentials and plaintext API keys. Notably, the tokens generated will remain active even after the requireLogin feature is re-enabled, creating a significant security risk.

References