Live › vulnerability › CVE-2026-118984
OmniRoute 3.8.0 before 3.8.52 lets holders of manage- or admin-scoped API keys or oma_ access tokens change the management password without the current password. An attacker can also disable the login requirement or lock the operator out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
OmniRoute 3.8.0 up to but not including 3.8.52 is affected. Exposure depends on holders of manage- or admin-scoped API keys or oma_ access tokens, so teams that issue broad keys to many users or services are most at risk. The sources do not say whether a default configuration is affected.
No product ranges from the sources yet.
3.8.523.8.52Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
This page as .md · .json · in your agent: get_signal("CVE-2026-118984")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.