OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.8.52
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
OmniRoute, an application affected by this flaw, can let unauthenticated users obtain sync tokens when its login requirement is turned off. Those tokens can then be used to retrieve stored provider credentials and plaintext API keys, and they remain valid even after login is turned back on.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- cheaper-inference OmniRoute
From 3.8.50 · fixed in 3.8.52