CVE-2026-118984
CVE-2026-118984 · OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
CVSS 7.0 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
omniroute
- Versiones
- ≥ 3.8.0, < 3.8.52: Afectada (semver)
Actualiza a 3.8.52
Fuentes originales
- https://github.com/cheaper-inference/OmniRoute/pull/16897
- https://github.com/cheaper-inference/OmniRoute/commit/dde27f4964872c9b43cfd5b8f532693f6c018af6
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/require-login/route.ts#L90-L130
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/settings/route.ts#L374-L422
- https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
- https://github.com/cheaper-inference/OmniRoute
- https://www.vulncheck.com/advisories/omniroute-3.8.0-before-3.8.52-unverified-password-change-via-api-settings-require-login
- https://nvd.nist.gov/vuln/detail/CVE-2026-118984