CVE-2026-116634 OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

High 8.2 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116634?

CVE-2026-116634 is a high-severity vulnerability in cheaper-inference OmniRoute, published on 26 Oct 2026.

Official description

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.

Weakness: CWE-306

Which versions are affected by CVE-2026-116634?

How do I fix CVE-2026-116634?

No fix has been published for CVE-2026-116634 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116634 being exploited?

There is no known exploitation of CVE-2026-116634 in the wild and no public exploit code.

Sources

Also known as GHSA-fqp9-jcg9-vhfv.