{"schema":"threatline.record/2","record":{"id":"CVE-2026-116634","aliases":[],"summary":"OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens","details":"OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.","categories":["Unclassified"],"product":"OmniRoute","vendor":"cheaper-inference","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116634","source_modified_at":"2026-10-26T18:09:41.236Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"OmniRoute","vendor":"cheaper-inference","versions":[{"version":"3.8.50","lessThan":"3.8.52","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116634","source_modified_at":"2026-10-26T18:09:41.236Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"OmniRoute","ecosystem":null},"version":"3.8.52","basis":"first unaffected version stated in the CVE record"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T18:09:41.236Z","modified_at":"2026-10-26T18:09:41.236Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116634","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T18:09:41.236Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/cheaper-inference/OmniRoute/pull/17053","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/cheaper-inference/OmniRoute/commit/44a29611bf088e351d8d40eacaabdc1794ed0c61","tags":["patch"]},{"source":"CVE List","url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/sync/tokens/route.ts#L28-L30","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/server/authz/routeGuard.ts#L154-L167","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/cheaper-inference/OmniRoute","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/omniroute-3.8.50-before-3.8.52-missing-authentication-via-api-sync-tokens","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T18:09:41.236Z","content_hash":"286094667525091aed93b0008b3ed3cedb46f17ec94fc1a6a4b0b734d5ed9247"}}