CVE-2026-118984
5.5 MEDIUMpublic exploit availablePublished 2026-10-29 · Updated 2026-10-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
Weaknesses
CWE-620
Public exploit & PoC references
- https://github.com/cheaper-inference/OmniRoute
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422
- https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6
- https://github.com/cheaper-inference/OmniRoute/pull/16897
- https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
All references
- https://github.com/cheaper-inference/OmniRoute
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422
- https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6
- https://github.com/cheaper-inference/OmniRoute/pull/16897
- https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
- https://www.vulncheck.com/advisories/omniroute-3.8.0-before-3.8.52-unverified-password-change-via-api-settings-require-login
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2013-20008PoC
- UNSCOREDCVE-2026-102603PoC
- MEDIUMCVE-2026-104106PoC
- MEDIUMCVE-2026-105785PoC
- MEDIUMCVE-2026-112002PoC
- HIGHCVE-2026-92467PoC
- HIGHCVE-2026-97380PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.