Unverified Password Change in OmniRoute by Cheaper Inference

CVE-2026-118984

What is CVE-2026-118984?

The OmniRoute application before version 3.8.52 is susceptible to an unverified password change vulnerability. Attackers with access to manage- or admin-scoped API keys or oma_ access tokens can exploit this flaw to change the management password without requiring the current password. This vulnerability enables unauthorized users to send POST requests to the endpoint /api/settings/require-login, potentially leading to account takeover, locking operators out of the dashboard, or disabling the login requirement entirely. This risk underscores the importance of securing API access tokens and implementing robust authentication mechanisms.

References