Skip to content
OpenAdvisories

Vendor

cheaper-inference

2 known vulnerabilities.

Products

OmniRoute 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-118984

    OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

    OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests t…

    cheaper-inference OmniRoute
  • Medium 5.9
    CVE-2026-116634

    OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

    OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle …

    cheaper-inference OmniRoute