OmniRoute: Missing authentication in sync token API exposes API keys
Summary
OmniRoute 3.8.50 before 3.8.52 lets unauthenticated attackers issue sync tokens via POST /api/sync/tokens, but only when the requireLogin setting is disabled. An attacker can use such a token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys. Issued tokens remain valid after login is re-enabled.
Affected
- OmniRoute 3.8.50 to before 3.8.52
- Exploitable only when requireLogin is disabled
Fixed in
- Fixed in OmniRoute 3.8.52
Workaround
- Keep login (requireLogin) enabled
- No other vendor mitigation known
Exploitation
- No public proof-of-concept known
- Not listed as known exploited (KEV)
- CISA SSVC: exploitation none, automatable no, technical impact partial
Our recommendation
- Update OmniRoute to version 3.8.52 or later
- Verify that requireLogin is enabled
- If the instance ran with login disabled, review and revoke existing sync tokens (DELETE /api/sync/tokens/:id)
- Rotate provider credentials and API keys on any instance that was reachable while login was disabled
- Check whether the instance is reachable from outside your network and restrict access
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: OmniRoute GitHub repository github.com
- Fix commit 44a29611 github.com
- Pull request #17053 github.com
- OmniRoute release v3.8.52 github.com
- VulnCheck advisory www.vulncheck.com
- Affected code: sync tokens route github.com
- Affected code: route guard github.com
- VulDB entry vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:53.
Original description (NVD)
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.
NVD references (7)
- https://github.com/cheaper-inference/OmniRoute
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/sync…
- https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/server/authz…
- https://github.com/cheaper-inference/OmniRoute/commit/44a29611bf088e351d8d40eacaabdc1794ed0c61
- https://github.com/cheaper-inference/OmniRoute/pull/17053
- https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52
- https://www.vulncheck.com/advisories/omniroute-3.8.50-before-3.8.52-missing-authentication-via-api-sync-tokens
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.