5.9
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116634
OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens
OmniRoute · Missing authentication · CWE-306AffectedOmniRoute
FixUpdate to 3.8.52 or newer
PublishedOct 26, 18:09 · VulnCheck
ScoredOct 26 · 5.9 · VulnCheck
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read data. CVSS impact.
Description
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inOmniRoute3.8.50 – before 3.8.523.8.52
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known