Live › vulnerability › CVE-2026-116634
Go to dashboardOmniRoute before 3.8.52 lets an unauthenticated attacker request a sync token from POST /api/sync/tokens when requireLogin is disabled. That token then retrieves decrypted provider credentials and plaintext API keys from GET /api/sync/bundle, and it keeps working after login is re-enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Teams running OmniRoute from 3.8.50 up to but not including 3.8.52 that have requireLogin disabled at any point, since the issued tokens persist after login is re-enabled. Instances with login enforced throughout are not exposed through this path. Deployments on 3.8.52 or later are not affected.
No product ranges from the sources yet.
3.8.52 are affectedrequireLogin is disabled in the OmniRoute configuration/api/sync/tokens or /api/sync/bundle from unknown sources3.8.52 or laterrequireLogin was disabledEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-116634")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.