CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

High 7.0 Published 29 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118984?

CVE-2026-118984 is a high-severity vulnerability in cheaper-inference OmniRoute, published on 29 Oct 2026.

Official description

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

Weakness: CWE-620

Which versions are affected by CVE-2026-118984?

How do I fix CVE-2026-118984?

No fix has been published for CVE-2026-118984 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118984 being exploited?

There is no known exploitation of CVE-2026-118984 in the wild and no public exploit code.

Sources

Also known as GHSA-3625-cmv6-g9c2.