CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

CVE-2026-118984

OmniRoute versions 3.8.0 before 3.8.52 are vulnerable to an unverified password change vulnerability. The flaw allows holders of manage-scoped or admin-scoped API keys, or oma_ access tokens, to change the management password without providing the current password. An attacker can exploit this by...

EUVD-2026-112722

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...