CVE-2026-116634: OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OmniRouteto a version that resolves this vulnerability.Fixed in 3.8.52
Event History
Frequently Asked Questions
Which deployments are exposed?
OmniRoute versions 3.8.50 before 3.8.52 are exposed when requireLogin is disabled. In that state, an unauthenticated network attacker can send a POST request to /api/sync/tokens.
What can an attacker obtain with an issued sync token?
The token can be used against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys. No prior authentication or user interaction is required when requireLogin is disabled.
Does re-enabling login invalidate tokens issued while login was disabled?
No. Tokens issued during the exposed configuration persist after login is re-enabled, so previously issued tokens may still be usable to retrieve the sync bundle.