OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.8.52
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
OmniRoute, an API gateway and dashboard product, is affected by this flaw. An attacker holding a manage- or admin-scoped API key or access token could change the management password without knowing the current one, locking out the operator, taking over the dashboard, or turning off the login requirement altogether.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- cheaper-inference OmniRoute
From 3.8.0 · fixed in 3.8.52