5.5
MediumCVSS 3.1 · from VulnCheck
CVE-2026-118984
OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
OmniRoute · CWE-620 · CWE-620AffectedOmniRoute
FixUpdate to 3.8.52 or newer
PublishedOct 29, 10:44 · VulnCheck
ScoredOct 29 · 5.5 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can change data. CVSS impact.
Description
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inOmniRoute3.8.0 – before 3.8.523.8.52
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known