Approved changes feed: RSS · Atom
cpe:2.3:a:cheaper-inference:omniroute:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cheaper Inference (e5e3df5b-9291-5b6f-ad28-6f7bee19b6f8) |
|---|---|
| Product | Omniroute (21a4c550-cab1-5338-8442-b1d810d4fd85) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-118984 |
vulnerable | 2026-11-03 10:17:04.529565 |
OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
MEDIUM (5.5)
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Published: 2026-10-29T10:44:39.676Z
Updated: 2026-10-29T12:36:53.458Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116634 |
vulnerable | 2026-11-03 10:15:22.065375 |
OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens
MEDIUM (5.9)
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Published: 2026-10-26T18:09:41.236Z
Updated: 2026-10-26T19:34:36.562Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.